Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
B&&u.apply(this,arguments)}),O=mxUtils.bind(this,function(){window.clearTimeout(F);B&&A.apply(this,arguments)});l=l||{};l.callbackId=this.remoteInvokeCallbacks.length;this.remoteInvokeCallbacks.push({callback:M,error:O});d=JSON.stringify({event:"remoteInvoke",funtionName:d,functionArgs:f,msgMarkers:l});null!=this.remoteWin?this.remoteWin.postMessage(d,"*"):this.remoteInvokeQueue.push(d)};EditorUi.prototype.handleRemoteInvoke=function(d,f){var l=mxUtils.bind(this,function(H,ja){var da={event:"remoteInvokeResponse",
msgMarkers:d.msgMarkers};null!=ja?da.error={errResp:ja}:null!=H&&(da.resp=H);this.remoteWin.postMessage(JSON.stringify(da),"*")});try{var u=d.funtionName,A=this.remoteInvokableFns[u];if(null!=A&&"function"===typeof this[u]){if(A.allowedDomains){for(var B=!1,F=0;F<A.allowedDomains.length;F++)if(f=="https://"+A.allowedDomains[F]){B=!0;break}if(!B){l(null,"Invalid Call: "+u+" is not allowed.");return}}var M=d.functionArgs;Array.isArray(M)||(M=[]);if(A.isAsync)M.push(function(){l(Array.prototype.slice.apply(arguments))}),
M.push(function(H){l(null,H||"Unkown Error")}),this[u].apply(this,M);else{var O=this[u].apply(this,M);l([O])}}else l(null,"Invalid Call: "+u+" is not found.")}catch(H){l(null,"Invalid Call: An error occurred, "+H.message)}};EditorUi.prototype.openDatabase=function(d,f){if(null==this.database){var l=window.indexedDB||window.mozIndexedDB||window.webkitIndexedDB;if(null!=l)try{var u=l.open("database",2);u.onupgradeneeded=function(A){try{var B=u.result;1>A.oldVersion&&B.createObjectStore("objects",{keyPath:"key"});