Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null,M),0<Q.length&&(m=mxUtils.parseXml(Q),m=m.documentElement))))}if(null!=m&&"svg"==m.nodeName)if(Q=m.getAttribute("content"),null!=Q&&"<"!=Q.charAt(0)&&"%"!=Q.charAt(0)&&(Q=unescape(window.atob?atob(Q):Base64.decode(cont,Q))),null!=Q&&"%"==Q.charAt(0)&&(Q=decodeURIComponent(Q)),null!=Q&&0<Q.length)m=mxUtils.parseXml(Q).documentElement;else throw{message:mxResources.get("notADiagramFile")};null==m||A||(U=null,"diagram"==m.nodeName?U=m:"mxfile"==m.nodeName&&(Q=m.getElementsByTagName("diagram"),0<
Q.length&&(U=Q[Math.max(0,Math.min(Q.length-1,urlParams.page||0))])),null!=U&&(m=Editor.parseDiagramNode(U,M)));null==m||"mxGraphModel"==m.nodeName||A&&"mxfile"==m.nodeName||(m=null);return m};Editor.parseDiagramNode=function(m,A){var M=mxUtils.trim(mxUtils.getTextContent(m)),Q=null;0<M.length?(m=Graph.decompress(M,null,A),null!=m&&0<m.length&&(Q=mxUtils.parseXml(m).documentElement)):(m=mxUtils.getChildNodes(m),0<m.length&&(Q=mxUtils.createXmlDocument(),Q.appendChild(Q.importNode(m[0],!0)),Q=Q.documentElement));