Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
O,y=x=null,A()):this.ui.spinner.spin(z,mxResources.get("loading"))&&(P=encodeURIComponent(P.slice(2,P.length).join("/")),this.getFile(G+"/"+O+"/"+P,mxUtils.bind(this,function(N){this.ui.spinner.stop();k=N.meta.org;l=N.meta.repo;x=decodeURIComponent(N.meta.ref);y="";v()}),mxUtils.bind(this,function(N){this.ui.spinner.stop();this.ui.handleError({message:mxResources.get("fileNotFound")})})))}else this.ui.spinner.stop(),this.ui.handleError({message:mxResources.get("invalidName")})}}),mxResources.get("enterValue"));