Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
M=F.getChildren(F.root);for(A=0;A<M.length;A++){var O=M[A];F.setVisible(O,f[O.id]||!1)}}catch(H){}};EditorUi.prototype.getBaseFilename=function(d){var f=this.getCurrentFile();f=null!=f&&null!=f.getTitle()?f.getTitle():this.defaultFilename;if(/(\.xml)$/i.test(f)||/(\.html)$/i.test(f)||/(\.svg)$/i.test(f)||/(\.png)$/i.test(f))f=f.substring(0,f.lastIndexOf("."));/(\.drawio)$/i.test(f)&&(f=f.substring(0,f.lastIndexOf(".")));!d&&null!=this.pages&&1<this.pages.length&&null!=this.currentPage&&null!=this.currentPage.node.getAttribute("name")&&
0<this.currentPage.getName().length&&(f=f+"-"+this.currentPage.getName());return f};EditorUi.prototype.downloadFile=function(d,f,l,u,A,B,F,M,O,H,ja,da){try{u=null!=u?u:this.editor.graph.isSelectionEmpty();var ca=this.getBaseFilename("remoteSvg"==d?!1:!A),ia=ca+("xml"==d||"pdf"==d&&ja?".drawio":"")+"."+d;if("xml"==d){var ma=Graph.xmlDeclaration+"\n"+this.getFileData(!0,null,null,null,u,A,null,null,null,f);this.saveData(ia,d,ma,"text/xml")}else if("html"==d)ma=this.getHtml2(this.getFileData(!0),this.editor.graph,