Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!0,D=window.setTimeout(mxUtils.bind(this,function(){E=!1;c({code:App.ERROR_TIMEOUT})}),this.ui.timeout),z=this.client.filesGetMetadata({path:"/"+e.path.substring(1),include_deleted:!1});z.then(mxUtils.bind(this,function(M){}));z["catch"](function(M){window.clearTimeout(D);E&&null!=M&&409==M.status&&(E=!1,c({message:mxResources.get("fileNotFound")}))});z=this.client.filesDownload(e);z.then(mxUtils.bind(this,function(M){window.clearTimeout(D);if(E){E=!1;try{var I=new FileReader;I.onload=mxUtils.bind(this,