Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.bind(this,function(U){this.spinner.stop();B(Graph.xmlDeclaration+"\n"+Graph.svgDoctype+"\n"+mxUtils.getXml(U))})))}else C=q+".svg",m=this.getFileData(!1,!0,null,mxUtils.bind(this,function(U){this.spinner.stop();B(U)}),t)}}catch(U){this.handleError(U)}};EditorUi.prototype.createDownloadRequest=function(d,g,n,t,u,v,A,H,L,F,S,p,q){d=this.downloadRequestBuilder(d,g,n,t,u,v,A,H,L,F,S,p,q);g="";for(var C in d)n=d[C],null!=n&&(g+=C+"="+encodeURIComponent(n)+"&");return new mxXmlRequest(EXPORT_URL,
g)};EditorUi.prototype.downloadRequestBuilder=function(d,g,n,t,u,v,A,H,L,F,S,p,q){var C=this.editor.graph,J=C.getGraphBounds();n=this.getFileData(!0,null,null,null,n,0==v?!1:"xmlpng"!=g,null,null,null,!Editor.defaultCompressed,"pdf"==g);var G=null,P=null,O=null;if(J.width*J.height>MAX_AREA||n.length>MAX_REQUEST_SIZE)throw{message:mxResources.get("drawingTooLarge")};F=F?"1":"0";"pdf"==g&&(null!=S?(G=S.from,P=S.to):0==v&&(O="1"));"xmlpng"==g&&(F="1",g="png");if(("xmlpng"==g||"svg"==g)&&null!=this.pages&&