Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
f.handleFileError(null,!0):this.spinner.spin(document.body,mxResources.get("updatingDocument"))&&(f.clearAutosave(),this.editor.setStatus(""),d?f.reloadFile(mxUtils.bind(this,function(){f.handleFileSuccess("manual"==DrawioFile.SYNC)}),mxUtils.bind(this,function(l){f.handleFileError(l,!0)})):f.synchronizeFile(mxUtils.bind(this,function(){f.handleFileSuccess("manual"==DrawioFile.SYNC)}),mxUtils.bind(this,function(l){f.handleFileError(l,!0)}))))};EditorUi.prototype.getFileData=function(d,f,l,u,A,B,F,
M,O,H,ja){A=null!=A?A:!0;B=null!=B?B:!1;H=null!=H?H:!Editor.defaultCompressed;var da=this.editor.graph;if(f||!d&&null!=O&&/(\.svg)$/i.test(O.getTitle())){var ca=null!=da.themes&&"darkTheme"==da.defaultThemeName;if(ca||null!=this.pages&&this.currentPage!=this.pages[0]){var ia=da.getGlobalVariable;da=this.createTemporaryGraph(ca?da.getDefaultStylesheet():da.getStylesheet());da.setBackgroundImage=this.editor.graph.setBackgroundImage;da.background=this.editor.graph.background;var ma=null!=this.pages?
this.pages[0]:null;null==ma||this.currentPage==ma?da.setBackgroundImage(this.editor.graph.backgroundImage):null!=ma.viewState&&null!=ma.viewState&&da.setBackgroundImage(ma.viewState.backgroundImage);da.getGlobalVariable=function(aa){return"page"==aa&&null!=ma?ma.getName():"pagenumber"==aa?1:ia.apply(this,arguments)};document.body.appendChild(da.container);null!=ma&&da.model.setRoot(ma.root)}}F=null!=F?F:this.getXmlFileData(A,B,H,ja);O=null!=O?O:this.getCurrentFile();d=this.createFileData(F,da,O,window.location.href,
d,f,l,u,A,M,H);da!=this.editor.graph&&da.container.parentNode.removeChild(da.container);return d};EditorUi.prototype.getHtml=function(d,f,l,u,A,B){B=null!=B?B:!0;var F=null,M=EditorUi.drawHost+"/js/embed-static.min.js";if(null!=f){F=B?f.getGraphBounds():f.getBoundingBox(f.getSelectionCells());var O=f.view.scale;B=Math.floor(F.x/O-f.view.translate.x);O=Math.floor(F.y/O-f.view.translate.y);F=f.background;null==A&&(f=this.getBasenames().join(";"),0<f.length&&(M=EditorUi.drawHost+"/embed.js?s="+f));d.setAttribute("x0",