Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
aa)}catch(la){this.handleError(la)}else this.handleError({message:mxResources.get("errorSavingFile")})}),mxUtils.bind(this,function(la){this.spinner.stop();this.handleError(la)}))}),null!=ia?ca(ia):this.pickFolder(da,ca)))}});if("1"==urlParams["save-dialog"]){var O=[App.MODE_BROWSER];F||O.push("_blank");d=new SaveDialog(this,d,mxUtils.bind(this,function(ja,da,ca){M(ja.value,da,ja,ca);this.hideDialog()}),O,null,"application/pdf");this.showDialog(d.container,420,100,!0,!1,mxUtils.bind(this,function(){this.hideDialog()}))}else{O=