Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
R.length&&(U=R[Math.max(0,Math.min(R.length-1,urlParams.page||0))])),null!=U&&(m=Editor.parseDiagramNode(U,K)));null==m||"mxGraphModel"==m.nodeName||B&&"mxfile"==m.nodeName||(m=null);return m};Editor.parseDiagramNode=function(m,B){var K=mxUtils.trim(mxUtils.getTextContent(m)),R=null;0<K.length?(m=Graph.decompress(K,null,B),null!=m&&0<m.length&&(R=mxUtils.parseXml(m).documentElement)):(m=mxUtils.getChildNodes(m),0<m.length&&(R=mxUtils.createXmlDocument(),R.appendChild(R.importNode(m[0],!0)),R=R.documentElement));
return R};Editor.getDiagramNodeXml=function(m){var B=mxUtils.getTextContent(m),K=null;0<B.length?K=Graph.decompress(B):null!=m.firstChild&&(K=mxUtils.getXml(m.firstChild));return K};Editor.extractGraphModelFromPdf=function(m){m=m.substring(m.indexOf(",")+1);m=window.atob&&!mxClient.IS_SF?atob(m):Base64.decode(m,!0);if("%PDF-1.7"==m.substring(0,8)){var B=m.indexOf("EmbeddedFile");if(-1<B){var K=m.indexOf("stream",B)+9;if(0<m.substring(B,K).indexOf("application#2Fvnd.jgraph.mxfile"))return B=m.indexOf("endstream",