Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
else if("svg"==n)d.hideDialog(),d.saveData(g,"svg",mxUtils.getXml(L.getSvg(t,u,v)),"image/svg+xml");else{var F=d.getFileData(!0,null,null,null,null,!0),S=L.getGraphBounds(),p=Math.floor(S.width*u/L.view.scale),q=Math.floor(S.height*u/L.view.scale);if(F.length<=MAX_REQUEST_SIZE&&p*q<MAX_AREA)if(d.hideDialog(),"png"!=n&&"jpg"!=n&&"jpeg"!=n||!d.isExportToCanvas()){var C={globalVars:L.getExportVariables()};H&&(C.grid={size:L.gridSize,steps:L.view.gridSteps,color:L.view.gridColor});d.saveRequest(g,n,function(J,
G){return new mxXmlRequest(EXPORT_URL,"format="+n+"&base64="+(G||"0")+(null!=J?"&filename="+encodeURIComponent(J):"")+"&extras="+encodeURIComponent(JSON.stringify(C))+(0<A?"&dpi="+A:"")+"&bg="+(null!=t?t:"none")+"&w="+p+"&h="+q+"&border="+v+"&xml="+encodeURIComponent(F))})}else"png"==n?d.exportImage(u,null==t||"none"==t,!0,!1,!1,v,!0,!1,null,H,A):d.exportImage(u,!1,!0,!1,!1,v,!0,!1,"jpeg",H);else mxUtils.alert(mxResources.get("drawingTooLarge"))}});EditorUi.prototype.getDiagramTextContent=function(){this.editor.graph.setEnabled(!1);