Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.updateGraphXml(Editor.parseDiagramNode(this.diagrams[this.currentPage])))};this.selectPageById=function(k){k=this.getIndexById(k);var v=0<=k;v&&this.selectPage(k);return v};F=mxUtils.bind(this,function(){if(null==this.xmlNode||"mxfile"!=this.xmlNode.nodeName)this.diagrams=[];this.xmlNode!=R&&(this.diagrams=this.xmlNode.getElementsByTagName("diagram"),R=this.xmlNode)});var W=this.graph.setBackgroundImage;this.graph.setBackgroundImage=function(k){if(null!=k&&Graph.isPageLink(k.src)){var v=k.src,
z=v.indexOf(",");0<z&&(z=N.getIndexById(v.substring(z+1)),0<=z&&(k=N.getImageForGraphModel(Editor.parseDiagramNode(N.diagrams[z])),k.originalSrc=v))}W.apply(this,arguments)};var d=this.graph.getGraphBounds;this.graph.getGraphBounds=function(k){var v=d.apply(this,arguments);k=this.backgroundImage;if(null!=k){var z=this.view.translate,A=this.view.scale;v=mxRectangle.fromRectangle(v);v.add(new mxRectangle((z.x+k.x)*A,(z.y+k.y)*A,k.width*A,k.height*A))}return v};this.addListener("xmlNodeChanged",F);F();