Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.bind(this,function(ia){ca===this.currentPage&&(200<=ia.getStatus()&&300>=ia.getStatus()?(this.updateDiagram(ia.getText()),fa()):this.handleError({message:mxResources.get("error")+" "+ia.getStatus()}))}),mxUtils.bind(this,function(ia){this.handleError(ia)}))}),fa=mxUtils.bind(this,function(){window.clearTimeout(G);G=window.setTimeout(ja,O)});this.editor.addListener("pageSelected",mxUtils.bind(this,function(){fa();ja()}));fa();ja()}null!=f&&f()});if(null!=d.url&&0<d.url.length){var A=this.editor.getProxiedUrl(d.url);