Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.htmlEntities(b.getPageName())+(b.isBackground()?" (Background)":"");b=mxUtils.htmlEntities(b.getPageNameU());a+='<diagram name="'+c+'" id="'+b.replace(/\s/g,"_")+'">'}return a+=Graph.compress(g)};m.prototype.scalePoint=function(g,b){null!=g&&(g.x*=b,g.y*=b);return g};m.prototype.scaleRect=function(g,b){null!=g&&(g.x*=b,g.y*=b,g.height*=b,g.width*=b);return g};m.prototype.importNodes=function(g,b,a,c){var d=a.lastIndexOf("/"),f=a,k=a;if(-1!==d&&(f=a.substring(0,d),k=a.substring(d+1,a.length),
a=function(z,E){return z[E]?z[E]:null}(c,f+"/_rels/"+k+".rels"),null!=a)){var n=a.getElementsByTagName("Relationship");a={};for(d=0;d<n.length;d++){k=n.item(d);var p=k.getAttribute("Id");k=k.getAttribute("Target");a[p]=k}b=b.getElementsByTagName("Rel");for(d=0;d<b.length;d++)if(n=b.item(d),k=function(z,E){return z[E]?z[E]:null}(a,n.getAttribute("r:id")),k=f+"/"+k,null!=k&&(p=c[k]?c[k]:null,null!=p)){n=n.parentNode;for(p=p.firstChild;null!=p&&1!=p.nodeType;)p=p.nextSibling;if(null!=p&&1==p.nodeType)for(p=
p.firstChild;null!=p;){if(null!=p&&1==p.nodeType){var x=n.appendChild(g.importNode(p,!0));this.importNodes(g,x,k,c)}p=p.nextSibling}}}};m.prototype.layerIndexToNames=function(g){var b=[];if(g)for(var a=0;a<g.length;a++){var c=parseInt(g[a]);c<this.layerNames.length&&b.push(this.layerNames[c])}return 0<b.length?b:[mxResources.get("background")]};m.prototype.importPage=function(g,b,a,c){var d=g.getBackPage();if(null!=d){b.getModel().setValue(b.getDefaultParent(),g.getPageName());var f=new mxCell(d.getPageName());