Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
localStorage.key(e),q=localStorage.getItem(g);if(0<g.length&&(".scratchpad"==g||"."!=g.charAt(0))&&0<q.length){var p="<mxfile "===q.substring(0,8)||"<?xml"===q.substring(0,5)||"\x3c!--[if IE]>"===q.substring(0,12);q="<mxlibrary>"===q.substring(0,11);(p||q)&&c.push(g)}}return c};EditorUi.prototype.getLocalStorageFile=function(c){if("1"==localStorage.getItem(".localStorageMigrated")&&"1"!=urlParams.forceMigration)return null;var e=localStorage.getItem(c);return{title:c,data:e,isLib:"<mxlibrary>"===
e.substring(0,11)}};EditorUi.prototype.setMigratedFlag=function(){localStorage.setItem(".localStorageMigrated","1")}})();