Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
App.prototype.fileCreated=function(b,f,m,d,u,v){var D=window.location.pathname;null!=f&&0<f.length&&(D+="?libs="+f);null!=u&&0<u.length&&(D+="?clibs="+u);D=this.getUrl(D);b.getMode()!=App.MODE_DEVICE&&(D+="#"+b.getHash());if(this.spinner.spin(document.body,mxResources.get("inserting"))){var F=b.getData();F=0<F.length?this.editor.extractGraphModel(mxUtils.parseXml(F).documentElement,!0):null;var K=window.location.protocol+"//"+window.location.hostname+D,M=F,G=null;null!=F&&/\.svg$/i.test(b.getTitle())&&
(G=this.createTemporaryGraph(this.editor.graph.getStylesheet()),document.body.appendChild(G.container),M=this.decodeNodeIntoGraph(M,G));b.setData(this.createFileData(F,G,b,K));null!=G&&G.container.parentNode.removeChild(G.container);var S=mxUtils.bind(this,function(){this.spinner.stop()}),J=mxUtils.bind(this,function(){S();var c=this.getCurrentFile();null==m&&null!=c&&(m=!c.isModified()&&null==c.getMode());var e=mxUtils.bind(this,function(){window.openFile=null;this.fileLoaded(b,null,v);m&&b.addAllSavedStatus();
null!=f&&this.sidebar.showEntries(f);if(null!=u){for(var q=[],p=u.split(";"),t=0;t<p.length;t++)q.push(decodeURIComponent(p[t]));this.loadLibraries(q)}}),k=mxUtils.bind(this,function(){m||null==c||!c.isModified()?e():this.confirm(mxResources.get("allChangesLost"),null,e,mxResources.get("cancel"),mxResources.get("discardChanges"))});null!=d&&d();null==m||m?k():(b.constructor==LocalFile&&(window.openFile=new OpenFile(function(){window.openFile=null}),window.openFile.setData(b.getData(),b.getTitle(),
null==b.getMode())),null!=d&&d(),window.openWindow(D,null,k))});b.constructor==LocalFile?J():b.saveFile(b.getTitle(),!1,mxUtils.bind(this,function(){J()}),mxUtils.bind(this,function(c){S();null!=c&&"AbortError"==c.name||this.handleError(c)}))}};