Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
A.parentNode.removeChild(A)}catch(L){}}else this.createEchoRequest(d,g,n,t,u).simulate(document,"_blank")}};EditorUi.prototype.createEchoRequest=function(d,g,n,t,u,v){d="xml="+encodeURIComponent(d);return new mxXmlRequest(SAVE_URL,d+(null!=n?"&mime="+n:"")+(null!=u?"&format="+u:"")+(null!=v?"&base64="+v:"")+(null!=g?"&filename="+encodeURIComponent(g):"")+(t?"&binary=1":""))};EditorUi.prototype.base64ToBlob=function(d,g){g=g||"";d=atob(d);for(var n=d.length,t=Math.ceil(n/1024),u=Array(t),v=0;v<t;++v){for(var A=