Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.createLibraryDataFromImages=function(d){if(!Editor.defaultCompressed)for(var f=0;f<d.length;f++)null!=d[f].xml&&"<"!=d[f].xml.charAt(0)&&(d[f].xml=mxUtils.trim(Graph.decompress(d[f].xml)));f=mxUtils.createXmlDocument();var k=f.createElement("mxlibrary");mxUtils.setTextContent(k,JSON.stringify(d,null,2));f.appendChild(k);return mxUtils.getXml(f,"\n")};EditorUi.prototype.closeLibrary=function(d){null!=d&&(this.removeLibrarySidebar(d.getHash()),d.constructor!=LocalLibrary&&mxSettings.removeCustomLibrary(d.getHash()),