Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(q){v=null!=v?v:"pdf"==g?"application/pdf":"image/"+g;if(null!=t)try{this.exportFile(t,F,v,!0,S,q)}catch(C){this.handleError(C)}else this.spinner.spin(document.body,mxResources.get("saving"))&&p.send(mxUtils.bind(this,function(){this.spinner.stop();if(200<=p.getStatus()&&299>=p.getStatus())try{this.exportFile(p.getText(),F,v,!0,S,q)}catch(C){this.handleError(C)}else this.handleError({message:mxResources.get("errorSavingFile")})}),mxUtils.bind(this,function(C){this.spinner.stop();this.handleError(C)}))})))}}),