Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
return P};Editor.getDiagramNodeXml=function(k){var y=mxUtils.getTextContent(k),G=null;0<y.length?G=Graph.decompress(y):null!=k.firstChild&&(G=mxUtils.getXml(k.firstChild));return G};Editor.extractGraphModelFromPdf=function(k){k=k.substring(k.indexOf(",")+1);k=window.atob&&!mxClient.IS_SF?atob(k):Base64.decode(k,!0);if("%PDF-1.7"==k.substring(0,8)){var y=k.indexOf("EmbeddedFile");if(-1<y){var G=k.indexOf("stream",y)+9;if(0<k.substring(y,G).indexOf("application#2Fvnd.jgraph.mxfile"))return y=k.indexOf("endstream",
G-1),pako.inflateRaw(Graph.stringToArrayBuffer(k.substring(G,y)),{to:"string"})}return null}G=null;y="";for(var P=0,Q=0,U=[],T=null;Q<k.length;){var W=k.charCodeAt(Q);Q+=1;10!=W&&(y+=String.fromCharCode(W));W=="/Subject (%3Cmxfile".charCodeAt(P)?P++:P=0;if(19==P){var X=k.indexOf("%3C%2Fmxfile%3E)",Q)+15;Q-=9;if(X>Q){G=k.substring(Q,X);break}}10==W&&("endobj"==y?T=null:"obj"==y.substring(y.length-3,y.length)||"xref"==y||"trailer"==y?(T=[],U[y.split(" ")[0]]=T):null!=T&&T.push(y),y="")}null==G&&(G=
Editor.extractGraphModelFromXref(U));null!=G&&(G=decodeURIComponent(G.replace(/\\\(/g,"(").replace(/\\\)/g,")")));return G};Editor.extractGraphModelFromXref=function(k){var y=k.trailer,G=null;null!=y&&(y=/.* \/Info (\d+) (\d+) R/g.exec(y.join("\n")),null!=y&&0<y.length&&(y=k[y[1]],null!=y&&(y=/.* \/Subject (\d+) (\d+) R/g.exec(y.join("\n")),null!=y&&0<y.length&&(k=k[y[1]],null!=k&&(k=k.join("\n"),G=k.substring(1,k.length-1))))));return G};Editor.extractParserError=function(k,y){var G=null;k=null!=