Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
l.setBackgroundImage(C.viewState.backgroundImage);l.getGlobalVariable=function(D){return"page"==D&&null!=C?C.getName():"pagenumber"==D?1:z.apply(this,arguments)};document.body.appendChild(l.container);null!=C&&l.model.setRoot(C.root)}}x=null!=x?x:this.getXmlFileData(p,t,A,S);I=null!=I?I:this.getCurrentFile();c=this.createFileData(x,l,I,window.location.href,c,e,g,q,p,B,A);l!=this.editor.graph&&l.container.parentNode.removeChild(l.container);return c};EditorUi.prototype.getHtml=function(c,e,g,q,p,t){t=