Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
StorageFile.insertFile=function(b,f,m,d,u){var v=mxUtils.bind(this,function(E){var F=function(){var L=new StorageFile(b,m,f);L.saveFile(f,!1,function(){d(L)},u)};E?b.confirm(mxResources.get("replaceIt",[f]),F,u):F()});StorageFile.getFileContent(b,f,function(E){v(null!=E)},function(){v(!1)})};StorageFile.getFileContent=function(b,f,m,d){b.getDatabaseItem(f,function(u){m(null!=u?u.data:null)},mxUtils.bind(this,function(){null==b.database?b.getLocalData(f,m):null!=d&&d()}),"files")};