Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ba.charAt(0)&&(ba=decodeURIComponent(ba)),null!=ba&&0<ba.length)m=mxUtils.parseXml(ba).documentElement;else throw{message:mxResources.get("notADiagramFile")};null==m||C||(V=null,"diagram"==m.nodeName?V=m:"mxfile"==m.nodeName&&(ba=m.getElementsByTagName("diagram"),0<ba.length&&(V=ba[Math.max(0,Math.min(ba.length-1,urlParams.page||0))])),null!=V&&(m=Editor.parseDiagramNode(V,M)));null==m||"mxGraphModel"==m.nodeName||C&&"mxfile"==m.nodeName||(m=null);return m};Editor.parseDiagramNode=function(m,C){var M=
mxUtils.trim(mxUtils.getTextContent(m)),ba=null;0<M.length?(m=Graph.decompress(M,null,C),null!=m&&0<m.length&&(ba=mxUtils.parseXml(m).documentElement)):(m=mxUtils.getChildNodes(m),0<m.length&&(ba=mxUtils.createXmlDocument(),ba.appendChild(ba.importNode(m[0],!0)),ba=ba.documentElement));return ba};Editor.getDiagramNodeXml=function(m){var C=mxUtils.getTextContent(m),M=null;0<C.length?M=Graph.decompress(C):null!=m.firstChild&&(M=mxUtils.getXml(m.firstChild));return M};Editor.extractGraphModelFromPdf=