Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
N.cell.id,N.text),O=!1);O||G++;P++});console.log("states checked",P,"invalid",G)}));c.actions.addAction("testCheckFile",mxUtils.bind(this,function(){var p=null!=c.pages&&null!=c.getCurrentFile()?c.getCurrentFile().getAnonymizedXmlForPages(c.pages):"";p=new TextareaDialog(c,"Paste Data:",p,function(q){if(0<q.length)try{var C=function(N){function T(Y){if(null==X[Y]){if(X[Y]=!0,null!=K[Y]){for(;0<K[Y].length;){var Z=K[Y].pop();T(Z)}delete K[Y]}}else mxLog.debug(m+": Visited: "+Y)}var m=N.parentNode.id,
B=N.childNodes;N={};for(var K={},R=null,U={},W=0;W<B.length;W++){var Q=B[W];if(null!=Q.id&&0<Q.id.length)if(null==N[Q.id]){N[Q.id]=Q.id;var V=Q.getAttribute("parent");null==V?null!=R?mxLog.debug(m+": Multiple roots: "+Q.id):R=Q.id:(null==K[V]&&(K[V]=[]),K[V].push(Q.id))}else U[Q.id]=Q.id}B=Object.keys(U);0<B.length?(B=m+": "+B.length+" Duplicates: "+B.join(", "),mxLog.debug(B+" (see console)")):mxLog.debug(m+": Checked");var X={};null==R?mxLog.debug(m+": No root"):(T(R),Object.keys(X).length!=Object.keys(N).length&&
(mxLog.debug(m+": Invalid tree: (see console)"),console.log(m+": Invalid tree",K)))};"<"!=q.charAt(0)&&(q=Graph.decompress(q),mxLog.debug("See console for uncompressed XML"),console.log("xml",q));var J=mxUtils.parseXml(q),G=c.getPagesForNode(J.documentElement,"mxGraphModel");if(null!=G&&0<G.length)try{var P=c.getHashValueForPages(G);mxLog.debug("Checksum: ",P)}catch(N){mxLog.debug("Error: ",N.message)}else mxLog.debug("No pages found for checksum");var O=J.getElementsByTagName("root");for(q=0;q<O.length;q++)C(O[q]);