Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.htmlEntities(b.getPageName())+(b.isBackground()?" (Background)":"");b=mxUtils.htmlEntities(b.getPageNameU());a+='<diagram name="'+c+'" id="'+b.replace(/\s/g,"_")+'">'}return a+=Graph.compress(g)};m.prototype.scalePoint=function(g,b){null!=g&&(g.x*=b,g.y*=b);return g};m.prototype.scaleRect=function(g,b){null!=g&&(g.x*=b,g.y*=b,g.height*=b,g.width*=b);return g};m.prototype.importNodes=function(g,b,a,c){var d=a.lastIndexOf("/"),f=a,k=a;if(-1!==d&&(f=a.substring(0,d),k=a.substring(d+1,a.length),