Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
return Q};Editor.getDiagramNodeXml=function(m){var A=mxUtils.getTextContent(m),M=null;0<A.length?M=Graph.decompress(A):null!=m.firstChild&&(M=mxUtils.getXml(m.firstChild));return M};Editor.extractGraphModelFromPdf=function(m){m=m.substring(m.indexOf(",")+1);m=window.atob&&!mxClient.IS_SF?atob(m):Base64.decode(m,!0);if("%PDF-1.7"==m.substring(0,8)){var A=m.indexOf("EmbeddedFile");if(-1<A){var M=m.indexOf("stream",A)+9;if(0<m.substring(A,M).indexOf("application#2Fvnd.jgraph.mxfile"))return A=m.indexOf("endstream",
M-1),pako.inflateRaw(Graph.stringToArrayBuffer(m.substring(M,A)),{to:"string"})}return null}M=null;A="";for(var Q=0,U=0,W=[],P=null;U<m.length;){var V=m.charCodeAt(U);U+=1;10!=V&&(A+=String.fromCharCode(V));V=="/Subject (%3Cmxfile".charCodeAt(Q)?Q++:Q=0;if(19==Q){var X=m.indexOf("%3C%2Fmxfile%3E)",U)+15;U-=9;if(X>U){M=m.substring(U,X);break}}10==V&&("endobj"==A?P=null:"obj"==A.substring(A.length-3,A.length)||"xref"==A||"trailer"==A?(P=[],W[A.split(" ")[0]]=P):null!=P&&P.push(A),A="")}null==M&&(M=
Editor.extractGraphModelFromXref(W));null!=M&&(M=decodeURIComponent(M.replace(/\\\(/g,"(").replace(/\\\)/g,")")));return M};Editor.extractGraphModelFromXref=function(m){var A=m.trailer,M=null;null!=A&&(A=/.* \/Info (\d+) (\d+) R/g.exec(A.join("\n")),null!=A&&0<A.length&&(A=m[A[1]],null!=A&&(A=/.* \/Subject (\d+) (\d+) R/g.exec(A.join("\n")),null!=A&&0<A.length&&(m=m[A[1]],null!=m&&(m=m.join("\n"),M=m.substring(1,m.length-1))))));return M};Editor.extractParserError=function(m,A){var M=null;m=null!=