Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
t)}))}else c({message:mxResources.get("accessDenied")});else D="&t="+(new Date).getTime(),d=this.baseUrl+"/projects/"+encodeURIComponent(z+"/"+M)+"/repository/files/"+encodeURIComponent(e)+"?ref="+I,y=new mxXmlRequest(d+D,null,"GET"),this.executeRequest(y,mxUtils.bind(this,function(g){try{f(this.createGitLabFile(z,M,I,JSON.parse(g.getText()),k,E))}catch(n){c(n)}}),c)}),c,x)};GitLabClient.prototype.getFileContent=function(e){var f=e.file_name,c=e.content;"base64"===e.encoding&&(/\.jpe?g$/i.test(f)?
c="data:image/jpeg;base64,"+c:/\.gif$/i.test(f)?c="data:image/gif;base64,"+c:/\.pdf$/i.test(f)?c="data:application/pdf;base64,"+c:/\.png$/i.test(f)?(e=this.ui.extractGraphModelFromPng(c),c=null!=e&&0<e.length?e:"data:image/png;base64,"+c):c=Base64.decode(c));return c};GitLabClient.prototype.createGitLabFile=function(e,f,c,k,l,x){var y=DRAWIO_GITLAB_URL+"/";e={org:e,repo:f,ref:c,name:k.file_name,path:k.file_path,html_url:y+e+"/"+f+"/blob/"+c+"/"+k.file_path,download_url:y+e+"/"+f+"/raw/"+c+"/"+k.file_path+