Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(J){this.spinner.stop();try{this.saveCanvas(J,u?this.getFileData(!0,null,null,null,n,H):null,L,null==this.pages||0==this.pages.length,S)}catch(G){this.handleError(G)}}),null,this.thumbImageCache,null,mxUtils.bind(this,function(J){this.spinner.stop();this.handleError(J)}),null,n,d||1,g,t,null,null,v,A,F,p,q)}catch(J){this.spinner.stop(),this.handleError(J)}}};EditorUi.prototype.isCorsEnabledForUrl=function(d){return this.editor.isCorsEnabledForUrl(d)};EditorUi.prototype.importXml=function(d,