Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
try{this.ui.pages=this.ui.applyPatches(this.ui.pages,b,!0,f,this.isModified()),0==this.ui.pages.length&&this.ui.pages.push(this.ui.createPage()),0>mxUtils.indexOf(this.ui.pages,this.ui.currentPage)&&this.ui.selectPage(this.ui.pages[0],!0)}finally{F.container.style.visibility="";F.model.endUpdate();F.cellRenderer.redraw=R;this.changeListenerEnabled=L;m||(u.history=v,u.indexOfNextAdd=E,u.fireEvent(new mxEventObject(mxEvent.CLEAR)));if(null==this.ui.currentPage||this.ui.currentPage.needsUpdate)H!=F.mathEnabled?
(this.ui.editor.updateGraphComponents(),F.refresh()):(N!=F.foldingEnabled?F.view.revalidate():F.view.validate(),F.sizeDidChange());null!=this.sync&&this.isRealtime()&&!d&&(this.sync.snapshot=this.ui.clonePages(this.ui.pages));this.ui.editor.fireEvent(new mxEventObject("pagesPatched","patches",b))}EditorUi.debug("DrawioFile.patch",[this],"patches",b,"resolver",f,"undoable",m)}return b};