Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!this.editor.editable&&(g.getHash=function(){return"G"+e},window.location.hash="#"+g.getHash());null!=d&&d()}));return!0}return!1});!c()&&this.spinner.spin(document.body,mxResources.get("loading"))&&this.addListener("clientLoaded",c);return!0});this.loadTemplate(H,mxUtils.bind(this,function(c){this.spinner.stop();if(null!=c&&0<c.length){var e=this.defaultFilename;if(null==urlParams.title&&"1"!=urlParams.notitle){var g=H,q=H.lastIndexOf("."),p=g.lastIndexOf("/");q>p&&0<p&&(g=g.substring(p+1,q),q=H.substring(q),