Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
B)}else if("view"==d.nodeName){if(d.hasAttribute("scale")&&(A.view.scale=parseFloat(d.getAttribute("scale"))),d.hasAttribute("dx")||d.hasAttribute("dy"))A.view.translate=new mxPoint(parseFloat(d.getAttribute("dx")||0),parseFloat(d.getAttribute("dy")||0))}else"fit"==d.nodeName&&(F=d.hasAttribute("max-scale")?parseFloat(d.getAttribute("max-scale")):1);d=d.nextSibling}}finally{B.endUpdate()}null!=F&&this.chromelessResize&&this.chromelessResize(!0,F)}return l};EditorUi.prototype.getCopyFilename=function(d,
f){var l=null!=d&&null!=d.getTitle()?d.getTitle():this.defaultFilename;d="";var u=l.lastIndexOf(".");0<=u&&(d=l.substring(u),l=l.substring(0,u));if(f){f=l;var A=new Date;l=A.getFullYear();u=A.getMonth()+1;var B=A.getDate(),F=A.getHours(),M=A.getMinutes();A=A.getSeconds();l=f+(" "+(l+"-"+u+"-"+B+"-"+F+"-"+M+"-"+A))}return l=mxResources.get("copyOf",[l])+d};EditorUi.prototype.fileLoaded=function(d,f,l){var u=this.getCurrentFile();this.fileEditable=this.fileLoadedError=null;this.setCurrentFile(null);