Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.patchPages=function(b,e,f,c,k){var l={},x=[],y={},E={},D={},z={};if(null!=c&&null!=c[EditorUi.DIFF_UPDATE])for(var M in c[EditorUi.DIFF_UPDATE])l[M]=c[EditorUi.DIFF_UPDATE][M];if(null!=e[EditorUi.DIFF_REMOVE])for(c=0;c<e[EditorUi.DIFF_REMOVE].length;c++)E[e[EditorUi.DIFF_REMOVE][c]]=!0;if(null!=e[EditorUi.DIFF_INSERT])for(c=0;c<e[EditorUi.DIFF_INSERT].length;c++)y[e[EditorUi.DIFF_INSERT][c].previous]=e[EditorUi.DIFF_INSERT][c];if(null!=e[EditorUi.DIFF_UPDATE])for(M in e[EditorUi.DIFF_UPDATE])c=
e[EditorUi.DIFF_UPDATE][M],null!=c.previous&&(z[c.previous]=M);if(null!=b){var I="";for(c=0;c<b.length;c++){var d=b[c].getId();D[d]=b[c];null!=z[I]||E[d]||null!=e[EditorUi.DIFF_UPDATE]&&null!=e[EditorUi.DIFF_UPDATE][d]&&null!=e[EditorUi.DIFF_UPDATE][d].previous||(z[I]=d);I=d}}var g={},n=mxUtils.bind(this,function(u){var v=null!=u?u.getId():"";if(null!=u&&!g[v]){g[v]=!0;x.push(u);var A=null!=e[EditorUi.DIFF_UPDATE]?e[EditorUi.DIFF_UPDATE][v]:null;null!=A&&(this.updatePageRoot(u),null!=A.name&&u.setName(A.name),
null!=A.view&&this.patchViewState(u,A.view),null!=A.cells&&this.patchPage(u,A.cells,l[u.getId()],k),!f||null==A.cells&&null==A.view||(u.needsUpdate=!0))}u=z[v];null!=u&&(delete z[v],n(D[u]));u=y[v];null!=u&&(delete y[v],t(u))}),t=mxUtils.bind(this,function(u){u=mxUtils.parseXml(u.data).documentElement;u=new DiagramPage(u);this.updatePageRoot(u);var v=D[u.getId()];null==v?n(u):(this.patchPage(v,this.diffPages([v],[u]),l[v.getId()],k),f&&(v.needsUpdate=!0))});n();for(M in z)n(D[z[M]]),delete z[M];for(M in y)t(y[M]),
delete y[M];return x};EditorUi.prototype.patchViewState=function(b,e){if(null!=b.viewState&&null!=e){b==this.currentPage&&(b.viewState=this.editor.graph.getViewState());for(var f in e)try{this.patchViewStateProperty(b,e,f)}catch(c){}b==this.currentPage&&this.editor.graph.setViewState(b.viewState,!0)}};EditorUi.prototype.patchViewStateProperty=function(b,e,f){b.viewState[f]=JSON.parse(e[f])};