Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
m.viewState.scale=1;delete m.viewState.scrollLeft;delete m.viewState.scrollTop;delete m.viewState.currentRoot;delete m.viewState.defaultParent;m.setName(f);m=this.insertPage(m,mxUtils.indexOf(this.pages,b)+1)}}catch(L){this.handleError(L)}return m};EditorUi.prototype.initDiagramNode=function(b){var f=(new mxCodec(mxUtils.createXmlDocument())).encode(new mxGraphModel(b.root));this.editor.graph.saveViewState(b.viewState,f);mxUtils.setTextContent(b.node,Graph.compressNode(f))};