Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
z.code=null);D(z)})))};GitHubClient.prototype.checkExists=function(e,f,c){var k=e.split("/"),l=k[0],x=k[1],y=k[2];e=k.slice(3,k.length).join("/");this.getSha(l,x,e,y,mxUtils.bind(this,function(E){if(f){var D=this.ui.spinner.pause();this.ui.confirm(mxResources.get("replaceIt",[e]),function(){D();c(!0,E)},function(){D();c(!1)})}else this.ui.spinner.stop(),this.ui.showError(mxResources.get("error"),mxResources.get("fileExists"),mxResources.get("ok"),function(){c(!1)})}),mxUtils.bind(this,function(E){c(!0)}),
!0)};GitHubClient.prototype.saveFile=function(e,f,c,k,l){var x=e.meta.org,y=e.meta.repo,E=e.meta.ref,D=e.meta.path,z=mxUtils.bind(this,function(I,d){this.writeFile(x,y,E,D,l,d,I,mxUtils.bind(this,function(g){delete e.meta.isNew;f(JSON.parse(g.getText()).content.sha)}),mxUtils.bind(this,function(g){c(g)}))}),M=mxUtils.bind(this,function(){if(this.ui.useCanvasForExport&&/(\.png)$/i.test(D)){var I=this.ui.getPngFileProperties(this.ui.fileNode);this.ui.getEmbeddedPng(mxUtils.bind(this,function(d){z(e.meta.sha,