Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
return R};Editor.getDiagramNodeXml=function(m){var B=mxUtils.getTextContent(m),K=null;0<B.length?K=Graph.decompress(B):null!=m.firstChild&&(K=mxUtils.getXml(m.firstChild));return K};Editor.extractGraphModelFromPdf=function(m){m=m.substring(m.indexOf(",")+1);m=window.atob&&!mxClient.IS_SF?atob(m):Base64.decode(m,!0);if("%PDF-1.7"==m.substring(0,8)){var B=m.indexOf("EmbeddedFile");if(-1<B){var K=m.indexOf("stream",B)+9;if(0<m.substring(B,K).indexOf("application#2Fvnd.jgraph.mxfile"))return B=m.indexOf("endstream",
K-1),pako.inflateRaw(Graph.stringToArrayBuffer(m.substring(K,B)),{to:"string"})}return null}K=null;B="";for(var R=0,U=0,W=[],Q=null;U<m.length;){var V=m.charCodeAt(U);U+=1;10!=V&&(B+=String.fromCharCode(V));V=="/Subject (%3Cmxfile".charCodeAt(R)?R++:R=0;if(19==R){var X=m.indexOf("%3C%2Fmxfile%3E)",U)+15;U-=9;if(X>U){K=m.substring(U,X);break}}10==V&&("endobj"==B?Q=null:"obj"==B.substring(B.length-3,B.length)||"xref"==B||"trailer"==B?(Q=[],W[B.split(" ")[0]]=Q):null!=Q&&Q.push(B),B="")}null==K&&(K=
Editor.extractGraphModelFromXref(W));null!=K&&(K=decodeURIComponent(K.replace(/\\\(/g,"(").replace(/\\\)/g,")")));return K};Editor.extractGraphModelFromXref=function(m){var B=m.trailer,K=null;null!=B&&(B=/.* \/Info (\d+) (\d+) R/g.exec(B.join("\n")),null!=B&&0<B.length&&(B=m[B[1]],null!=B&&(B=/.* \/Subject (\d+) (\d+) R/g.exec(B.join("\n")),null!=B&&0<B.length&&(m=m[B[1]],null!=m&&(m=m.join("\n"),K=m.substring(1,m.length-1))))));return K};Editor.extractParserError=function(m,B){var K=null;m=null!=