Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
e+"?ref="+D;var z={Authorization:"token "+b};x=e.split("/");this.ui.convertFile(l,0<x.length?x[x.length-1]:e,null,this.extension,f,c,null,z)}else c({message:mxResources.get("accessDenied")});else x="&t="+(new Date).getTime(),e=new mxXmlRequest(this.baseUrl+"/repos/"+y+"/"+E+"/contents/"+e+"?ref="+D+x,null,"GET"),this.executeRequest(e,mxUtils.bind(this,function(M){try{f(this.createGitHubFile(y,E,D,JSON.parse(M.getText()),k))}catch(I){c(I)}}),c)};GitHubClient.prototype.createGitHubFile=function(e,f,
c,k,l){e={org:e,repo:f,ref:c,name:k.name,path:k.path,sha:k.sha,html_url:k.html_url,download_url:k.download_url};f=k.content;"base64"===k.encoding&&(/\.jpe?g$/i.test(k.name)?f="data:image/jpeg;base64,"+f:/\.gif$/i.test(k.name)?f="data:image/gif;base64,"+f:/\.png$/i.test(k.name)?(k=this.ui.extractGraphModelFromPng(f),f=null!=k&&0<k.length?k:"data:image/png;base64,"+f):f=Base64.decode(f));return l?new GitHubLibrary(this.ui,f,e):new GitHubFile(this.ui,f,e)};GitHubClient.prototype.insertLibrary=function(e,