Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
c;else if("mxfile"==c.nodeName){var q=c.getElementsByTagName("diagram");if(0<q.length){g=q[0];var p=e.getGlobalVariable;e.getGlobalVariable=function(t){return"page"==t?g.getAttribute("name")||mxResources.get("pageWithNumber",[1]):"pagenumber"==t?1:p.apply(this,arguments)}}}null!=g&&(c=Editor.parseDiagramNode(g))}q=this.editor.graph;try{this.editor.graph=e,this.editor.setGraphXml(c)}catch(t){}finally{this.editor.graph=q}return c};EditorUi.prototype.getSvgFileProperties=function(c){return this.getPngFileProperties(c)};