Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
App.prototype.fileCreated=function(b,f,m,d,u,v){var E=window.location.pathname;null!=f&&0<f.length&&(E+="?libs="+f);null!=u&&0<u.length&&(E+="?clibs="+u);E=this.getUrl(E);b.getMode()!=App.MODE_DEVICE&&(E+="#"+b.getHash());if(this.spinner.spin(document.body,mxResources.get("inserting"))){var F=b.getData();F=0<F.length?this.editor.extractGraphModel(mxUtils.parseXml(F).documentElement,!0):null;var L=window.location.protocol+"//"+window.location.hostname+E,N=F,H=null;null!=F&&/\.svg$/i.test(b.getTitle())&&
(H=this.createTemporaryGraph(this.editor.graph.getStylesheet()),document.body.appendChild(H.container),N=this.decodeNodeIntoGraph(N,H));b.setData(this.createFileData(F,H,b,L));null!=H&&H.container.parentNode.removeChild(H.container);var R=mxUtils.bind(this,function(){this.spinner.stop()}),J=mxUtils.bind(this,function(){R();var c=this.getCurrentFile();null==m&&null!=c&&(m=!c.isModified()&&null==c.getMode());var e=mxUtils.bind(this,function(){window.openFile=null;this.fileLoaded(b,null,v);m&&b.addAllSavedStatus();
null!=f&&this.sidebar.showEntries(f);if(null!=u){for(var q=[],p=u.split(";"),t=0;t<p.length;t++)q.push(decodeURIComponent(p[t]));this.loadLibraries(q)}}),g=mxUtils.bind(this,function(){m||null==c||!c.isModified()?e():this.confirm(mxResources.get("allChangesLost"),null,e,mxResources.get("cancel"),mxResources.get("discardChanges"))});null!=d&&d();null==m||m?g():(b.constructor==LocalFile&&(window.openFile=new OpenFile(function(){window.openFile=null}),window.openFile.setData(b.getData(),b.getTitle(),
null==b.getMode())),null!=d&&d(),window.openWindow(E,null,g))});b.constructor==LocalFile?J():b.saveFile(b.getTitle(),!1,mxUtils.bind(this,function(){J()}),mxUtils.bind(this,function(c){R();null!=c&&"AbortError"==c.name||this.handleError(c)}))}};