Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
fa,ca)}catch(U){v(U)}};ja.src=O.result};O.onerror=function(G){v(G)}}else v(J)};H.onerror=function(J){v(J)};H.send()};EditorUi.prototype.insertAsPreText=function(d,f,k){var v=this.editor.graph,z=null;v.getModel().beginUpdate();try{z=v.insertVertex(null,null,"<pre>"+d+"</pre>",f,k,1,1,"text;html=1;align=left;verticalAlign=top;"),v.updateCellSize(z,!0)}finally{v.getModel().endUpdate()}return z};EditorUi.prototype.insertTextAt=function(d,f,k,v,z,A,H,J){A=null!=A?A:!0;H=null!=H?H:!0;if(null!=d)if(Graph.fileSupport&&