Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
d.getSize(),label:"autosave_"+(this.editor.autosave?"on":"off")+"_theme_"+F})}EditorUi.debug("File.opened",[d]);"1"==urlParams.viewerOnlyMsg&&this.showAlert(mxResources.get("viewerOnlyMsg"));if(this.editor.editable&&this.mode==d.getMode()&&d.getMode()!=App.MODE_DEVICE&&null!=d.getMode())try{this.addRecent({id:d.getHash(),title:d.getTitle(),mode:d.getMode()})}catch(M){}try{mxSettings.setOpenCounter(mxSettings.getOpenCounter()+1),mxSettings.save()}catch(M){}}catch(M){this.fileLoadedError=M;if(null!=
d)try{d.close()}catch(O){}if(EditorUi.enableLogging&&!this.isOffline())try{EditorUi.logEvent({category:"ERROR-LOAD-FILE-"+(null!=d?d.getHash():"none"),action:"message_"+M.message,label:"stack_"+M.stack})}catch(O){}d=mxUtils.bind(this,function(){null!=urlParams.url&&this.spinner.spin(document.body,mxResources.get("reconnecting"))?window.location.search=this.getSearch(["url"]):null!=u?this.fileLoaded(u)||B():B()});f?d():this.handleError(M,mxResources.get("errorLoadingFile"),d,!0,null,null,!0)}else B();
return A};EditorUi.prototype.getHashValueForPages=function(d,f){var l=0,u=new mxGraphModel,A=new mxCodec;null!=f&&(f.byteCount=0,f.attrCount=0,f.eltCount=0,f.nodeCount=0);for(var B=0;B<d.length;B++){this.updatePageRoot(d[B]);var F=d[B].node.cloneNode(!1);F.removeAttribute("name");u.root=d[B].root;var M=A.encode(u);this.editor.graph.saveViewState(d[B].viewState,M,!0);M.removeAttribute("pageWidth");M.removeAttribute("pageHeight");F.appendChild(M);null!=f&&(f.eltCount+=F.getElementsByTagName("*").length,