Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
App.prototype.createFile=function(b,f,m,d,u,v,E,F,L,N){d=F?null:null!=d?d:this.mode;if(null!=b&&this.spinner.spin(document.body,mxResources.get("inserting"))){f=null!=f?f:this.emptyDiagramXml;null==f||Editor.defaultCompressed||(f=this.uncompressPages(f));var H=mxUtils.bind(this,function(){this.spinner.stop()}),R=mxUtils.bind(this,function(J){H();null==J&&null==this.getCurrentFile()&&null==this.dialog?this.showSplash():null!=J&&this.handleError(J)});try{d==App.MODE_GOOGLE&&null!=this.drive?(null==
E&&null!=this.stateArg&&null!=this.stateArg.folderId&&(E=this.stateArg.folderId),this.drive.insertFile(b,f,E,mxUtils.bind(this,function(J){H();this.fileCreated(J,m,v,u,L,N)}),R)):d==App.MODE_GITHUB&&null!=this.gitHub?this.gitHub.insertFile(b,f,mxUtils.bind(this,function(J){H();this.fileCreated(J,m,v,u,L,N)}),R,!1,E):d==App.MODE_GITLAB&&null!=this.gitLab?this.gitLab.insertFile(b,f,mxUtils.bind(this,function(J){H();this.fileCreated(J,m,v,u,L,N)}),R,!1,E):d==App.MODE_TRELLO&&null!=this.trello?this.trello.insertFile(b,
f,mxUtils.bind(this,function(J){H();this.fileCreated(J,m,v,u,L,N)}),R,!1,E):d==App.MODE_DROPBOX&&null!=this.dropbox?this.dropbox.insertFile(b,f,mxUtils.bind(this,function(J){H();this.fileCreated(J,m,v,u,L,N)}),R):d==App.MODE_ONEDRIVE&&null!=this.oneDrive?this.oneDrive.insertFile(b,f,mxUtils.bind(this,function(J){H();this.fileCreated(J,m,v,u,L,N)}),R,!1,E):d==App.MODE_BROWSER?StorageFile.insertFile(this,b,f,mxUtils.bind(this,function(J){H();this.fileCreated(J,m,v,u,L,N)}),R):!F&&d==App.MODE_DEVICE&&
EditorUi.nativeFileSupport?(H(),this.showSaveFilePicker(mxUtils.bind(this,function(J,c){var e=new LocalFile(this,f,c.name,null,J,c);e.saveFile(c.name,!1,mxUtils.bind(this,function(){this.fileCreated(e,m,v,u,L,N)}),R,!0)}),mxUtils.bind(this,function(J){"AbortError"!=J.name&&R(J)}),this.createFileSystemOptions(b))):(H(),this.fileCreated(new LocalFile(this,f,b,null==d),m,v,u,L,N))}catch(J){H(),this.handleError(J)}}};