Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
I.cell.id,I.shape),z=!1);l(I.text)||(console.log("invalid text",I.cell.id,I.text),z=!1);z||P++;p++});console.log("states checked",p,"invalid",P)}));c.actions.addAction("testCheckFile",mxUtils.bind(this,function(){var l=null!=c.pages&&null!=c.getCurrentFile()?c.getCurrentFile().getAnonymizedXmlForPages(c.pages):"";l=new TextareaDialog(c,"Paste Data:",l,function(y){if(0<y.length)try{var J=function(I){function Q(aa){if(null==fa[aa]){if(fa[aa]=!0,null!=O[aa]){for(;0<O[aa].length;){var da=O[aa].pop();
Q(da)}delete O[aa]}}else mxLog.debug(N+": Visited: "+aa)}var N=I.parentNode.id,T=I.childNodes;I={};for(var O={},W=null,X={},Z=0;Z<T.length;Z++){var Y=T[Z];if(null!=Y.id&&0<Y.id.length)if(null==I[Y.id]){I[Y.id]=Y.id;var ba=Y.getAttribute("parent");null==ba?null!=W?mxLog.debug(N+": Multiple roots: "+Y.id):W=Y.id:(null==O[ba]&&(O[ba]=[]),O[ba].push(Y.id))}else X[Y.id]=Y.id}T=Object.keys(X);0<T.length?(T=N+": "+T.length+" Duplicates: "+T.join(", "),mxLog.debug(T+" (see console)")):mxLog.debug(N+": Checked");
var fa={};null==W?mxLog.debug(N+": No root"):(Q(W),Object.keys(fa).length!=Object.keys(I).length&&(mxLog.debug(N+": Invalid tree: (see console)"),console.log(N+": Invalid tree",O)))};"<"!=y.charAt(0)&&(y=Graph.decompress(y),mxLog.debug("See console for uncompressed XML"),console.log("xml",y));var G=mxUtils.parseXml(y),P=c.getPagesForNode(G.documentElement,"mxGraphModel");if(null!=P&&0<P.length)try{var p=c.getHashValueForPages(P);mxLog.debug("Checksum: ",p)}catch(I){mxLog.debug("Error: ",I.message)}else mxLog.debug("No pages found for checksum");