Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.patchPages=function(b,f,m,d,u){var v={},D=[],F={},K={},M={},G={};if(null!=d&&null!=d[EditorUi.DIFF_UPDATE])for(var S in d[EditorUi.DIFF_UPDATE])v[S]=d[EditorUi.DIFF_UPDATE][S];if(null!=f[EditorUi.DIFF_REMOVE])for(d=0;d<f[EditorUi.DIFF_REMOVE].length;d++)K[f[EditorUi.DIFF_REMOVE][d]]=!0;if(null!=f[EditorUi.DIFF_INSERT])for(d=0;d<f[EditorUi.DIFF_INSERT].length;d++)F[f[EditorUi.DIFF_INSERT][d].previous]=f[EditorUi.DIFF_INSERT][d];if(null!=f[EditorUi.DIFF_UPDATE])for(S in f[EditorUi.DIFF_UPDATE])d=
f[EditorUi.DIFF_UPDATE][S],null!=d.previous&&(G[d.previous]=S);if(null!=b){var J="";for(d=0;d<b.length;d++){var c=b[d].getId();M[c]=b[d];null!=G[J]||K[c]||null!=f[EditorUi.DIFF_UPDATE]&&null!=f[EditorUi.DIFF_UPDATE][c]&&null!=f[EditorUi.DIFF_UPDATE][c].previous||(G[J]=c);J=c}}var e={},k=mxUtils.bind(this,function(p){var t=null!=p?p.getId():"";if(null!=p&&!e[t]){e[t]=!0;D.push(p);var x=null!=f[EditorUi.DIFF_UPDATE]?f[EditorUi.DIFF_UPDATE][t]:null;null!=x&&(this.updatePageRoot(p),null!=x.name&&p.setName(x.name),
null!=x.view&&this.patchViewState(p,x.view),null!=x.cells&&this.patchPage(p,x.cells,v[p.getId()],u),!m||null==x.cells&&null==x.view||(p.needsUpdate=!0))}p=G[t];null!=p&&(delete G[t],k(M[p]));p=F[t];null!=p&&(delete F[t],q(p))}),q=mxUtils.bind(this,function(p){p=mxUtils.parseXml(p.data).documentElement;p=new DiagramPage(p);this.updatePageRoot(p);var t=M[p.getId()];null==t?k(p):(this.patchPage(t,this.diffPages([t],[p]),v[t.getId()],u),m&&(t.needsUpdate=!0))});k();for(S in G)k(M[G[S]]),delete G[S];for(S in F)q(F[S]),
delete F[S];return D};EditorUi.prototype.patchViewState=function(b,f){if(null!=b.viewState&&null!=f){b==this.currentPage&&(b.viewState=this.editor.graph.getViewState());for(var m in f)try{this.patchViewStateProperty(b,f,m)}catch(d){}b==this.currentPage&&this.editor.graph.setViewState(b.viewState,!0)}};EditorUi.prototype.patchViewStateProperty=function(b,f,m){b.viewState[m]=JSON.parse(f[m])};