Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
F.cell.id,F.shape),x=!1);f(F.text)||(console.log("invalid text",F.cell.id,F.text),x=!1);x||M++;k++});console.log("states checked",k,"invalid",M)}));d.actions.addAction("testCheckFile",mxUtils.bind(this,function(){var f=null!=d.pages&&null!=d.getCurrentFile()?d.getCurrentFile().getAnonymizedXmlForPages(d.pages):"";f=new TextareaDialog(d,"Paste Data:",f,function(u){if(0<u.length)try{var D=function(F){function Q(aa){if(null==fa[aa]){if(fa[aa]=!0,null!=R[aa]){for(;0<R[aa].length;){var ea=R[aa].pop();
Q(ea)}delete R[aa]}}else mxLog.debug(N+": Visited: "+aa)}var N=F.parentNode.id,U=F.childNodes;F={};for(var R={},W=null,X={},Z=0;Z<U.length;Z++){var Y=U[Z];if(null!=Y.id&&0<Y.id.length)if(null==F[Y.id]){F[Y.id]=Y.id;var ca=Y.getAttribute("parent");null==ca?null!=W?mxLog.debug(N+": Multiple roots: "+Y.id):W=Y.id:(null==R[ca]&&(R[ca]=[]),R[ca].push(Y.id))}else X[Y.id]=Y.id}U=Object.keys(X);0<U.length?(U=N+": "+U.length+" Duplicates: "+U.join(", "),mxLog.debug(U+" (see console)")):mxLog.debug(N+": Checked");
var fa={};null==W?mxLog.debug(N+": No root"):(Q(W),Object.keys(fa).length!=Object.keys(F).length&&(mxLog.debug(N+": Invalid tree: (see console)"),console.log(N+": Invalid tree",R)))};"<"!=u.charAt(0)&&(u=Graph.decompress(u),mxLog.debug("See console for uncompressed XML"),console.log("xml",u));var E=mxUtils.parseXml(u),M=d.getPagesForNode(E.documentElement,"mxGraphModel");if(null!=M&&0<M.length)try{var k=d.getHashValueForPages(M);mxLog.debug("Checksum: ",k)}catch(F){mxLog.debug("Error: ",F.message)}else mxLog.debug("No pages found for checksum");