Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Editor.extractGraphModelFromXref(U));null!=G&&(G=decodeURIComponent(G.replace(/\\\(/g,"(").replace(/\\\)/g,")")));return G};Editor.extractGraphModelFromXref=function(k){var y=k.trailer,G=null;null!=y&&(y=/.* \/Info (\d+) (\d+) R/g.exec(y.join("\n")),null!=y&&0<y.length&&(y=k[y[1]],null!=y&&(y=/.* \/Subject (\d+) (\d+) R/g.exec(y.join("\n")),null!=y&&0<y.length&&(k=k[y[1]],null!=k&&(k=k.join("\n"),G=k.substring(1,k.length-1))))));return G};Editor.extractParserError=function(k,y){var G=null;k=null!=
k?k.getElementsByTagName("parsererror"):null;null!=k&&0<k.length&&(G=y||mxResources.get("invalidChars"),y=k[0].getElementsByTagName("div"),0<y.length&&(G=mxUtils.getTextContent(y[0])));return null!=G?mxUtils.trim(G):G};Editor.addRetryToError=function(k,y){null!=k&&(k=null!=k.error?k.error:k,null==k.retry&&(k.retry=y))};Editor.mermaidToDrawio=function(k,y,G){if("function"===typeof mxMermaidToDrawio)return mxMermaidToDrawio(k,y,G)};Editor.configure=function(k){if(null!=k){Editor.config=k;Editor.configVersion=