Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
A/O.view.scale),ca=Math.floor(ja.height*A/O.view.scale);if(H.length<=MAX_REQUEST_SIZE&&da*ca<MAX_AREA)if(d.hideDialog(),"png"!=l&&"jpg"!=l&&"jpeg"!=l||!d.isExportToCanvas()){var ia={globalVars:O.getExportVariables()};M&&(ia.grid={size:O.gridSize,steps:O.view.gridSteps,color:O.view.gridColor});d.saveRequest(f,l,function(ma,aa){return new mxXmlRequest(EXPORT_URL,"format="+l+"&base64="+(aa||"0")+(null!=ma?"&filename="+encodeURIComponent(ma):"")+"&extras="+encodeURIComponent(JSON.stringify(ia))+(0<F?
"&dpi="+F:"")+"&bg="+(null!=u?u:"none")+"&w="+da+"&h="+ca+"&border="+B+"&xml="+encodeURIComponent(H))})}else"png"==l?d.exportImage(A,null==u||"none"==u,!0,!1,!1,B,!0,!1,null,M,F):d.exportImage(A,!1,!0,!1,!1,B,!0,!1,"jpeg",M);else mxUtils.alert(mxResources.get("drawingTooLarge"))}});EditorUi.prototype.getDiagramTextContent=function(){this.editor.graph.setEnabled(!1);var d=this.editor.graph,f="";if(null!=this.pages)for(var l=0;l<this.pages.length;l++){var u=d;this.currentPage!=this.pages[l]&&(u=this.createTemporaryGraph(d.getStylesheet()),