Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(m){m=m.substring(m.indexOf(",")+1);m=window.atob&&!mxClient.IS_SF?atob(m):Base64.decode(m,!0);if("%PDF-1.7"==m.substring(0,8)){var C=m.indexOf("EmbeddedFile");if(-1<C){var M=m.indexOf("stream",C)+9;if(0<m.substring(C,M).indexOf("application#2Fvnd.jgraph.mxfile"))return C=m.indexOf("endstream",M-1),pako.inflateRaw(Graph.stringToArrayBuffer(m.substring(M,C)),{to:"string"})}return null}M=null;C="";for(var ba=0,V=0,Z=[],aa=null;V<m.length;){var ka=m.charCodeAt(V);V+=1;10!=ka&&(C+=String.fromCharCode(ka));
ka=="/Subject (%3Cmxfile".charCodeAt(ba)?ba++:ba=0;if(19==ba){var qa=m.indexOf("%3C%2Fmxfile%3E)",V)+15;V-=9;if(qa>V){M=m.substring(V,qa);break}}10==ka&&("endobj"==C?aa=null:"obj"==C.substring(C.length-3,C.length)||"xref"==C||"trailer"==C?(aa=[],Z[C.split(" ")[0]]=aa):null!=aa&&aa.push(C),C="")}null==M&&(M=Editor.extractGraphModelFromXref(Z));null!=M&&(M=decodeURIComponent(M.replace(/\\\(/g,"(").replace(/\\\)/g,")")));return M};Editor.extractGraphModelFromXref=function(m){var C=m.trailer,M=null;null!=