Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(c){c=mxUtils.parseXml(c);var e=this.editor.extractGraphModel(c.documentElement);c=[];if(null!=e){var g=new mxCodec(e.ownerDocument),q=new mxGraphModel;g.decode(e,q);e=q.getChildAt(q.getRoot(),0);for(g=0;g<q.getChildCount(e);g++)c.push(q.getChildAt(e,g))}return c};EditorUi.prototype.openFileHandle=function(c,e,g,q,p){if(null!=e&&0<e.length){if(!this.useCanvasForExport&&/(\.png)$/i.test(e)||/(\.pdf)$/i.test(e))e=e.substring(0,e.length-4),/(\.drawio)$/i.test(e)||(e+=".drawio");var t=mxUtils.bind(this,