Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null!=b.currentPage&&null!=b.pages&&(L=mxUtils.indexOf(b.pages,b.currentPage));for(J=f.length-1;0<=J;J--){var T=function(W){var X=new Date(W.modifiedDate),Y=null;if(0<=X.getTime()){var Z=function(ha){c.stop();E.innerText="";var na=mxUtils.parseXml(ha),ea=b.editor.extractGraphModel(na.documentElement,!0);if(null!=ea){var za=function(Ba){null!=Ba&&(Ba=Ca(Editor.parseDiagramNode(Ba)));return Ba},Ca=function(Ba){var ba=Ba.getAttribute("background");if(null==ba||""==ba||ba==mxConstants.NONE)ba=F.defaultPageBackgroundColor;
v.style.backgroundColor=ba;(new mxCodec(Ba.ownerDocument)).decode(Ba,F.getModel());F.maxFitScale=1;F.fit(8);F.center();return Ba};O.style.display="none";O.innerText="";x=na;B=ha;N=parseSelectFunction=null;H=0;if("mxfile"==ea.nodeName){na=ea.getElementsByTagName("diagram");N=[];for(ha=0;ha<na.length;ha++)N.push(na[ha]);H=Math.min(L,N.length-1);0<N.length&&za(N[H]);if(1<N.length)for(O.removeAttribute("disabled"),O.style.display="",ha=0;ha<N.length;ha++)na=document.createElement("option"),ea=N[ha].getAttribute("name")||