Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null==f||f.constructor==EmbedFile||f.constructor==LocalFile&&null==f.mode||d.saveFile()},d.actions.addAction("saveAndExit",function(){"1"==urlParams.toSvg?d.sendEmbeddedSvgExport():d.actions.get("save").funct(!0)}).label="1"==urlParams.publishClose?mxResources.get("publish"):mxResources.get("saveAndExit"),d.actions.addAction("exit",function(){if("1"==urlParams.embedInline)d.sendEmbeddedSvgExport();else{var f=function(){d.editor.modified=!1;var u="json"==urlParams.proto?JSON.stringify({event:"exit",
modified:d.editor.modified}):"";(window.opener||window.parent).postMessage(u,"*")};d.editor.modified?d.confirm(mxResources.get("allChangesLost"),null,f,mxResources.get("cancel"),mxResources.get("discardChanges")):f()}},null,null,"1"==urlParams.embedInline?"Escape":null));this.put("exportAs",new Menu(mxUtils.bind(this,function(f,u){d.isExportToCanvas()?(this.addMenuItems(f,["exportPng"],u),d.jpgSupported&&this.addMenuItems(f,["exportJpg"],u)):d.isOffline()||mxClient.IS_IOS&&navigator.standalone||this.addMenuItems(f,