Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
OneDriveFile.prototype.saveFile=function(b,e,f,c,k,l){if(!this.isEditable())null!=f&&f();else if(!this.savingFile)if(this.getTitle()==b){var x=mxUtils.bind(this,function(){try{this.savingFileTime=new Date;this.setShadowModified(!1);this.savingFile=!0;var y=l||this.constructor!=OneDriveFile||"manual"!=DrawioFile.SYNC&&"auto"!=DrawioFile.SYNC?null:this.getCurrentEtag(),E=this.meta;null!=this.sync&&this.sync.fileSaving();this.ui.oneDrive.saveFile(this,mxUtils.bind(this,function(D,z){this.setModified(this.getShadowModified());
this.savingFile=!1;this.meta=D;this.fileSaved(z,E,mxUtils.bind(this,function(){this.contentChanged();null!=f&&f()}),c)}),mxUtils.bind(this,function(D,z){try{this.savingFile=!1,this.isConflict(z)?(this.inConflictState=!0,null!=this.sync?(this.savingFile=!0,this.sync.fileConflict(null,mxUtils.bind(this,function(){window.setTimeout(mxUtils.bind(this,function(){this.updateFileData();x()}),100+500*Math.random())}),mxUtils.bind(this,function(){this.savingFile=!1;null!=c&&c()}))):null!=c&&c()):null!=c&&
c(D)}catch(M){if(this.savingFile=!1,null!=c)c(M);else throw M;}}),y)}catch(D){if(this.savingFile=!1,null!=c)c(D);else throw D;}});x()}else this.savingFileTime=new Date,this.setShadowModified(!1),this.savingFile=!0,this.ui.oneDrive.insertFile(b,this.getData(),mxUtils.bind(this,function(y){this.setModified(this.getShadowModified());this.savingFile=!1;null!=f&&f();this.ui.fileLoaded(y)}),mxUtils.bind(this,function(){this.savingFile=!1;null!=c&&c()}))};