Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.createLibraryDataFromImages=function(d){if(!Editor.defaultCompressed)for(var f=0;f<d.length;f++)null!=d[f].xml&&"<"!=d[f].xml.charAt(0)&&(d[f].xml=mxUtils.trim(Graph.decompress(d[f].xml)));f=mxUtils.createXmlDocument();var k=f.createElement("mxlibrary");mxUtils.setTextContent(k,JSON.stringify(d,null,2));f.appendChild(k);return mxUtils.getXml(f,"\n")};EditorUi.prototype.closeLibrary=function(d){null!=d&&(this.removeLibrarySidebar(d.getHash()),d.constructor!=LocalLibrary&&mxSettings.removeCustomLibrary(d.getHash()),
".scratchpad"==d.title&&(this.scratchpad=null))};EditorUi.prototype.removeLibrarySidebar=function(d){var f=this.sidebar.palettes[d];if(null!=f){for(var k=0;k<f.length;k++)f[k].parentNode.removeChild(f[k]);delete this.sidebar.palettes[d]}};EditorUi.prototype.repositionLibrary=function(d){var f=this.sidebar.getEntryContainer();if(null==d){var k=this.sidebar.palettes["L.scratchpad"];null==k&&(k=this.sidebar.palettes.search);null!=k&&(d=k[k.length-1].nextSibling)}d=null!=d?d:f.firstChild.nextSibling.nextSibling;