Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Math.floor((new Date-c)/1E3);var e=Math.floor(c/31536E3);if(1<e)return e+" "+mxResources.get("years");e=Math.floor(c/2592E3);if(1<e)return e+" "+mxResources.get("months");e=Math.floor(c/86400);if(1<e)return e+" "+mxResources.get("days");e=Math.floor(c/3600);if(1<e)return e+" "+mxResources.get("hours");e=Math.floor(c/60);return 1<e?e+" "+mxResources.get("minutes"):1==e?e+" "+mxResources.get("minute"):null};EditorUi.prototype.decodeNodeIntoGraph=function(c,e){if(null!=c){var g=null;if("diagram"==c.nodeName)g=
c;else if("mxfile"==c.nodeName){var q=c.getElementsByTagName("diagram");if(0<q.length){g=q[0];var p=e.getGlobalVariable;e.getGlobalVariable=function(t){return"page"==t?g.getAttribute("name")||mxResources.get("pageWithNumber",[1]):"pagenumber"==t?1:p.apply(this,arguments)}}}null!=g&&(c=Editor.parseDiagramNode(g))}q=this.editor.graph;try{this.editor.graph=e,this.editor.setGraphXml(c)}catch(t){}finally{this.editor.graph=q}return c};EditorUi.prototype.getSvgFileProperties=function(c){return this.getPngFileProperties(c)};