Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
DrawioFile.prototype.reloadFile=function(b,f){try{this.ui.spinner.stop();var m=mxUtils.bind(this,function(){EditorUi.debug("DrawioFile.reloadFile",[this],"hash",this.getHash(),"modified",this.isModified(),"backupPatch",this.backupPatch);this.stats.fileReloaded++;if(""==this.getHash())this.mergeLatestVersion(null!=this.backupPatch?[this.backupPatch]:null,mxUtils.bind(this,function(){this.backupPatch=null;null!=b&&b()}),f);else{var d=this.ui.editor.graph,u=d.getSelectionCells(),v=d.getViewState(),E=
this.ui.currentPage;this.ui.loadFile(this.getHash(),!0,null,mxUtils.bind(this,function(){if(null==this.ui.fileLoadedError){this.ui.restoreViewState(E,v,u);null!=this.backupPatch&&this.patch([this.backupPatch]);var F=this.ui.getCurrentFile();null!=F&&(F.stats=this.stats);null!=b&&b()}}),!0)}});this.isModified()&&null==this.backupPatch?this.ui.confirm(mxResources.get("allChangesLost"),mxUtils.bind(this,function(){this.handleFileSuccess("manual"==DrawioFile.SYNC)}),m,mxResources.get("cancel"),mxResources.get("discardChanges")):
m()}catch(d){null!=f&&f(d)}};DrawioFile.prototype.mergeLatestVersion=function(b,f,m){this.getLatestVersion(mxUtils.bind(this,function(d){this.ui.editor.graph.model.beginUpdate();try{this.ui.replaceFileData(d.getData()),null!=b&&this.patch(b)}finally{this.ui.editor.graph.model.endUpdate()}this.inConflictState=this.invalidChecksum=!1;this.setDescriptor(d.getDescriptor());this.descriptorChanged();null!=f&&f()}),m)};