Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
p.setBackgroundImage(J.viewState.backgroundImage);p.getGlobalVariable=function(G){return"page"==G&&null!=J?J.getName():"pagenumber"==G?1:C.apply(this,arguments)};document.body.appendChild(p.container);null!=J&&p.model.setRoot(J.root)}}A=null!=A?A:this.getXmlFileData(u,v,F,S);L=null!=L?L:this.getCurrentFile();d=this.createFileData(A,p,L,window.location.href,d,g,n,t,u,H,F);p!=this.editor.graph&&p.container.parentNode.removeChild(p.container);return d};EditorUi.prototype.getHtml=function(d,g,n,t,u,v){v=