Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
A.parentNode.removeChild(A)}catch(L){}}else this.createEchoRequest(d,g,n,t,u).simulate(document,"_blank")}};EditorUi.prototype.createEchoRequest=function(d,g,n,t,u,v){d="xml="+encodeURIComponent(d);return new mxXmlRequest(SAVE_URL,d+(null!=n?"&mime="+n:"")+(null!=u?"&format="+u:"")+(null!=v?"&base64="+v:"")+(null!=g?"&filename="+encodeURIComponent(g):"")+(t?"&binary=1":""))};EditorUi.prototype.base64ToBlob=function(d,g){g=g||"";d=atob(d);for(var n=d.length,t=Math.ceil(n/1024),u=Array(t),v=0;v<t;++v){for(var A=
1024*v,H=Math.min(A+1024,n),L=Array(H-A),F=0;A<H;++F,++A)L[F]=d[A].charCodeAt(0);u[v]=new Uint8Array(L)}return new Blob(u,{type:g})};EditorUi.prototype.saveLocalFile=function(d,g,n,t,u,v,A,H){v=null!=v?v:!1;A=null!=A?A:"vsdx"!=u&&(!mxClient.IS_IOS||!navigator.standalone);u=this.getServiceCount(v);isLocalStorage&&u++;var L=4>=u?2:6<u?4:3;g=new CreateDialog(this,g,mxUtils.bind(this,function(F,S){try{if("_blank"==S)if(null!=n&&"image/"==n.substring(0,6))this.openInNewWindow(d,n,t);else if(null!=n&&"text/html"==