Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
DrawioFile.prototype.save=function(b,e,g,n,y,q){try{if(EditorUi.debug("DrawioFile.save",[this],"revision",b,"unloading",n,"overwrite",y,"manual",q,"saving",this.savingFile,"editable",this.isEditable(),"invalidChecksum",this.invalidChecksum),this.isEditable())if(!y&&this.invalidChecksum)if(null!=g)g({message:mxResources.get("checksum")});else throw Error(mxResources.get("checksum"));else this.updateFileData(),this.clearAutosave(),null!=e&&e();else if(null!=g)g({message:mxResources.get("readOnly")});
else throw Error(mxResources.get("readOnly"));}catch(E){if(null!=g)g(E);else throw E;}};DrawioFile.prototype.createData=function(){var b=this.ui.pages;if(this.isRealtime()&&(this.ui.pages=this.ownPages,null!=this.ui.currentPage)){var e=this.ui.getPageById(this.ui.currentPage.getId(),this.ownPages);null!=e&&(e.viewState=this.ui.editor.graph.getViewState(),e.needsUpdate=!0)}e=this.ui.getFileData(null,null,null,null,null,null,null,null,this,!this.isCompressed());this.ui.pages=b;return e};