Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
k=f.lastChild;var v=k.previousSibling;f.insertBefore(k,d);f.insertBefore(v,k)};EditorUi.prototype.loadLibrary=function(d,f){var k=mxUtils.parseXml(d.getData());if("mxlibrary"==k.documentElement.nodeName){var v=JSON.parse(mxUtils.getTextContent(k.documentElement));this.libraryLoaded(d,v,k.documentElement.getAttribute("title"),f)}else throw{message:mxResources.get("notALibraryFile")};};EditorUi.prototype.getLibraryStorageHint=function(d){return""};EditorUi.prototype.libraryLoaded=function(d,f,k,v){if(null!=