Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(d,f,l,u,A,B,F,M,O,H,ja,da,ca){d=this.downloadRequestBuilder(d,f,l,u,A,B,F,M,O,H,ja,da,ca);f="";for(var ia in d)l=d[ia],null!=l&&(f+=ia+"="+encodeURIComponent(l)+"&");return new mxXmlRequest(EXPORT_URL,f)};EditorUi.prototype.downloadRequestBuilder=function(d,f,l,u,A,B,F,M,O,H,ja,da,ca){var ia=this.editor.graph,ma=ia.getGraphBounds();l=this.getFileData(!0,null,null,null,l,0==B?!1:"xmlpng"!=f,null,null,null,!Editor.defaultCompressed,"pdf"==f);var aa=null,la=null,X=null;if(ma.width*ma.height>