Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
DrawioFile.prototype.fileSaved=function(b,e,g,n,y){this.lastSaved=new Date;this.ageStart=null;this.stats.saved++;try{this.invalidChecksum=this.inConflictState=!1;var q=this.ui.getPagesForXml(b);try{null==this.sync||this.isOptimisticSync()?(this.setShadowPages(q),null!=this.sync&&(this.sync.lastModified=this.getLastModifiedDate(),this.sync.resetUpdateStatusThread(),this.isRealtime()&&this.sync.scheduleCleanup()),null!=g&&g()):this.sync.fileSaved(q,e,g,n,y)}catch(T){this.invalidChecksum=this.inConflictState=
!0;this.descriptorChanged();null!=n&&n(T);try{if(this.errorReportsEnabled)this.sendErrorReport("Error in fileSaved",null,T);else{var E=this.getCurrentUser(),N=null!=E?E.id:"unknown";EditorUi.logError("Error in fileSaved",null,this.getMode()+"."+this.getId(),N,T)}}catch(F){}}EditorUi.debug("DrawioFile.fileSaved",[this],"savedData",[b],"inConflictState",this.inConflictState,"invalidChecksum",this.invalidChecksum)}catch(T){this.descriptorChanged(),null!=n&&n(T)}};