Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(d){var f=d.msgMarkers,l=this.remoteInvokeCallbacks[f.callbackId];if(null==l)throw Error("No callback for "+(null!=f?f.callbackId:"null"));d.error?l.error&&l.error(d.error.errResp):l.callback&&l.callback.apply(this,d.resp);this.remoteInvokeCallbacks[f.callbackId]=null};EditorUi.prototype.remoteInvoke=function(d,f,l,u,A){var B=!0,F=window.setTimeout(mxUtils.bind(this,function(){B=!1;A({code:App.ERROR_TIMEOUT,message:mxResources.get("timeout")})}),this.timeout),M=mxUtils.bind(this,function(){window.clearTimeout(F);