Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null,H),0<O.length&&(g=mxUtils.parseXml(O),g=g.documentElement))))}if(null!=g&&"svg"==g.nodeName)if(O=g.getAttribute("content"),null!=O&&"<"!=O.charAt(0)&&"%"!=O.charAt(0)&&(O=unescape(window.atob?atob(O):Base64.decode(cont,O))),null!=O&&"%"==O.charAt(0)&&(O=decodeURIComponent(O)),null!=O&&0<O.length)g=mxUtils.parseXml(O).documentElement;else throw{message:mxResources.get("notADiagramFile")};null==g||y||(P=null,"diagram"==g.nodeName?P=g:"mxfile"==g.nodeName&&(O=g.getElementsByTagName("diagram"),0<
O.length&&(P=O[Math.max(0,Math.min(O.length-1,urlParams.page||0))])),null!=P&&(g=Editor.parseDiagramNode(P,H)));null==g||"mxGraphModel"==g.nodeName||y&&"mxfile"==g.nodeName||(g=null);return g};Editor.parseDiagramNode=function(g,y){var H=mxUtils.trim(mxUtils.getTextContent(g)),O=null;0<H.length?(g=Graph.decompress(H,null,y),null!=g&&0<g.length&&(O=mxUtils.parseXml(g).documentElement)):(g=mxUtils.getChildNodes(g),0<g.length&&(O=mxUtils.createXmlDocument(),O.appendChild(O.importNode(g[0],!0)),O=O.documentElement));