Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
f,c,k,l){this.insertFile(e,f,c,k,!0,l,!1)};GitHubClient.prototype.insertFile=function(e,f,c,k,l,x,y){l=null!=l?l:!1;x=x.split("/");var E=x[0],D=x[1],z=x[2],M=x.slice(3,x.length).join("/");0<M.length&&(M+="/");M+=e;this.checkExists(E+"/"+D+"/"+z+"/"+M,!0,mxUtils.bind(this,function(I,d){I?l?(y||(f=Base64.encode(f)),this.showCommitDialog(e,!0,mxUtils.bind(this,function(g){this.writeFile(E,D,z,M,g,f,d,mxUtils.bind(this,function(n){try{var t=JSON.parse(n.getText());c(this.createGitHubFile(E,D,z,t.content,
l))}catch(u){k(u)}}),k)}),k)):c(new GitHubFile(this.ui,f,{org:E,repo:D,ref:z,name:e,path:M,sha:d,isNew:!0})):k()}))};GitHubClient.prototype.showCommitDialog=function(e,f,c,k){var l=this.ui.spinner.pause();e=new FilenameDialog(this.ui,mxResources.get(f?"addedFile":"updateFile",[e]),mxResources.get("ok"),mxUtils.bind(this,function(x){l();c(x)}),mxResources.get("commitMessage"),null,null,null,null,mxUtils.bind(this,function(){k()}),null,280);this.ui.showDialog(e.container,400,80,!0,!1);e.init()};GitHubClient.prototype.writeFile=