Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
DrawioFileSync.prototype.cleanup=function(b,f,m){window.clearTimeout(this.cleanupThread);if(this.isValidState()&&!this.file.inConflictState&&this.file.isRealtime()&&!this.file.isModified()){var d=[this.ui.diffPages(this.ui.pages,this.file.ownPages)];this.file.theirPages=this.ui.clonePages(this.file.ownPages);this.file.ignorePatches(d)||this.file.patch(d);EditorUi.debug("DrawioFileSync.cleanup",[this],"patches",d,"checkFile",m);m?this.file.getLatestVersion(mxUtils.bind(this,function(u){try{if(this.isValidState()&&
!this.file.inConflictState&&this.file.isRealtime()){var v=this.ui.getPagesForXml(u.data);d=[this.ui.diffPages(this.ui.pages,v),this.ui.diffPages(v,this.file.ownPages)];this.file.ignorePatches(d)||this.file.patch(d);EditorUi.debug("DrawioFileSync.cleanup",[this],"newFile",u,"patches",d)}null!=b&&b()}catch(E){null!=f&&f(E)}}),f):null!=b&&b()}else null!=b&&(b(),EditorUi.debug("DrawioFileSync.cleanup",[this],"checkFile",m,"modified",this.file.isModified()))};