Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
f,c,k,l,x,y,E,D){if(x.length>=this.maxFileSize)D({message:mxResources.get("drawingTooLarge")+" ("+this.ui.formatFileSize(x.length)+" / 10 MB)"});else{var z="POST";c={path:encodeURIComponent(k),branch:decodeURIComponent(c),commit_message:l,content:x,encoding:"base64"};null!=y&&(c.last_commit_id=y,z="PUT");e=this.baseUrl+"/projects/"+encodeURIComponent(e+"/"+f)+"/repository/files/"+encodeURIComponent(k);z=new mxXmlRequest(e,JSON.stringify(c),z);this.executeRequest(z,mxUtils.bind(this,function(M){E(M)}),
D)}};GitLabClient.prototype.saveFile=function(e,f,c,k,l){var x=e.meta.org,y=e.meta.repo,E=e.meta.ref,D=e.meta.path,z=mxUtils.bind(this,function(I,d){this.writeFile(x,y,E,D,l,d,I,mxUtils.bind(this,function(g){delete e.meta.isNew;this.getFile(x+"/"+y+"/"+E+"/"+D,mxUtils.bind(this,function(n){n.getData()==e.getData()?f(n.getCurrentEtag()):f({content:e.getCurrentEtag()})}),c,null,null,e.meta.refPos)}),c)}),M=mxUtils.bind(this,function(){if(this.ui.useCanvasForExport&&/(\.png)$/i.test(D)){var I=this.ui.getPngFileProperties(this.ui.fileNode);