Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.editor.setStatus(""),c?e.reloadFile(mxUtils.bind(this,function(){e.handleFileSuccess("manual"==DrawioFile.SYNC)}),mxUtils.bind(this,function(g){e.handleFileError(g,!0)})):e.synchronizeFile(mxUtils.bind(this,function(){e.handleFileSuccess("manual"==DrawioFile.SYNC)}),mxUtils.bind(this,function(g){e.handleFileError(g,!0)}))))};EditorUi.prototype.getFileData=function(c,e,g,q,p,t,x,B,I,A,S){p=null!=p?p:!0;t=null!=t?t:!1;A=null!=A?A:!Editor.defaultCompressed;var l=this.editor.graph;if(e||!c&&null!=
I&&/(\.svg)$/i.test(I.getTitle())){var n=null!=l.themes&&"darkTheme"==l.defaultThemeName;if(n||null!=this.pages&&this.currentPage!=this.pages[0]){var z=l.getGlobalVariable;l=this.createTemporaryGraph(n?l.getDefaultStylesheet():l.getStylesheet());l.setBackgroundImage=this.editor.graph.setBackgroundImage;l.background=this.editor.graph.background;var C=null!=this.pages?this.pages[0]:null;null==C||this.currentPage==C?l.setBackgroundImage(this.editor.graph.backgroundImage):null!=C.viewState&&null!=C.viewState&&
l.setBackgroundImage(C.viewState.backgroundImage);l.getGlobalVariable=function(D){return"page"==D&&null!=C?C.getName():"pagenumber"==D?1:z.apply(this,arguments)};document.body.appendChild(l.container);null!=C&&l.model.setRoot(C.root)}}x=null!=x?x:this.getXmlFileData(p,t,A,S);I=null!=I?I:this.getCurrentFile();c=this.createFileData(x,l,I,window.location.href,c,e,g,q,p,B,A);l!=this.editor.graph&&l.container.parentNode.removeChild(l.container);return c};EditorUi.prototype.getHtml=function(c,e,g,q,p,t){t=