Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
DrawioFile.prototype.fileSaved=function(b,f,m,d,u){this.lastSaved=new Date;this.ageStart=null;this.stats.saved++;try{this.invalidChecksum=this.inConflictState=!1;var v=this.ui.getPagesForXml(b);try{null==this.sync||this.isOptimisticSync()?(this.setShadowPages(v),null!=this.sync&&(this.sync.lastModified=this.getLastModifiedDate(),this.sync.resetUpdateStatusThread(),this.isRealtime()&&this.sync.scheduleCleanup()),null!=m&&m()):this.sync.fileSaved(v,f,m,d,u)}catch(L){this.invalidChecksum=this.inConflictState=
!0;this.descriptorChanged();null!=d&&d(L);try{if(this.errorReportsEnabled)this.sendErrorReport("Error in fileSaved",null,L);else{var E=this.getCurrentUser(),F=null!=E?E.id:"unknown";EditorUi.logError("Error in fileSaved",null,this.getMode()+"."+this.getId(),F,L)}}catch(N){}}EditorUi.debug("DrawioFile.fileSaved",[this],"savedData",[b],"inConflictState",this.inConflictState,"invalidChecksum",this.invalidChecksum)}catch(L){this.descriptorChanged(),null!=d&&d(L)}};