Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(null==this.scratchpad?StorageFile.getFileContent(this,".scratchpad",mxUtils.bind(this,function(c){null==c&&(c=this.emptyLibraryXml);this.loadLibrary(new StorageLibrary(this,c,".scratchpad"))})):this.closeLibrary(this.scratchpad))};EditorUi.prototype.createLibraryDataFromImages=function(c){if(!Editor.defaultCompressed)for(var e=0;e<c.length;e++)null!=c[e].xml&&"<"!=c[e].xml.charAt(0)&&(c[e].xml=mxUtils.trim(Graph.decompress(c[e].xml)));e=mxUtils.createXmlDocument();var g=e.createElement("mxlibrary");
mxUtils.setTextContent(g,JSON.stringify(c,null,2));e.appendChild(g);return mxUtils.getXml(e,"\n")};EditorUi.prototype.closeLibrary=function(c){null!=c&&(this.removeLibrarySidebar(c.getHash()),c.constructor!=LocalLibrary&&mxSettings.removeCustomLibrary(c.getHash()),".scratchpad"==c.title&&(this.scratchpad=null))};EditorUi.prototype.removeLibrarySidebar=function(c){var e=this.sidebar.palettes[c];if(null!=e){for(var g=0;g<e.length;g++)e[g].parentNode.removeChild(e[g]);delete this.sidebar.palettes[c]}};