Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.bind(this,function(Q){this.spinner.stop();y(Graph.xmlDeclaration+"\n"+Graph.svgDoctype+"\n"+mxUtils.getXml(Q))})))}else z=n+".svg",k=this.getFileData(!1,!0,null,mxUtils.bind(this,function(Q){this.spinner.stop();y(Q)}),q)}}catch(Q){this.handleError(Q)}};EditorUi.prototype.createDownloadRequest=function(c,e,g,q,p,t,x,B,I,A,S,l,n){c=this.downloadRequestBuilder(c,e,g,q,p,t,x,B,I,A,S,l,n);e="";for(var z in c)g=c[z],null!=g&&(e+=z+"="+encodeURIComponent(g)+"&");return new mxXmlRequest(EXPORT_URL,
e)};EditorUi.prototype.downloadRequestBuilder=function(c,e,g,q,p,t,x,B,I,A,S,l,n){var z=this.editor.graph,C=z.getGraphBounds();g=this.getFileData(!0,null,null,null,g,0==t?!1:"xmlpng"!=e,null,null,null,!Editor.defaultCompressed,"pdf"==e);var D=null,M=null,K=null;if(C.width*C.height>MAX_AREA||g.length>MAX_REQUEST_SIZE)throw{message:mxResources.get("drawingTooLarge")};A=A?"1":"0";"pdf"==e&&(null!=S?(D=S.from,M=S.to):0==t&&(K="1"));"xmlpng"==e&&(A="1",e="png");if(("xmlpng"==e||"svg"==e)&&null!=this.pages&&