Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(B=new mxCodec(mxUtils.createXmlDocument()),B=B.encode(new mxGraphModel(t.root)),this.editor.graph.saveViewState(t.viewState,B,null,q),x=x.cloneNode(!1),mxUtils.setTextContent(x,Graph.compressNode(B))));c(x)}return p};EditorUi.prototype.anonymizeString=function(c,e){for(var g=[],q=0;q<c.length;q++){var p=c.charAt(q);0<=EditorUi.ignoredAnonymizedChars.indexOf(p)?g.push(p):isNaN(parseInt(p))?p.toLowerCase()!=p?g.push(String.fromCharCode(65+Math.round(25*Math.random()))):p.toUpperCase()!=p?g.push(String.fromCharCode(97+
Math.round(25*Math.random()))):/\s/.test(p)?g.push(" "):g.push("?"):g.push(e?"0":Math.round(9*Math.random()))}return g.join("")};EditorUi.prototype.anonymizePatch=function(c){if(null!=c[EditorUi.DIFF_INSERT])for(var e=0;e<c[EditorUi.DIFF_INSERT].length;e++)try{var g=mxUtils.parseXml(c[EditorUi.DIFF_INSERT][e].data).documentElement.cloneNode(!1);null!=g.getAttribute("name")&&g.setAttribute("name",this.anonymizeString(g.getAttribute("name")));c[EditorUi.DIFF_INSERT][e].data=mxUtils.getXml(g)}catch(t){c[EditorUi.DIFF_INSERT][e].data=