Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.defaultFilename;L=new LocalFile(this,L,N,!0);null!=window.location.hash&&"#P"==window.location.hash.substring(0,2)&&(L.getHash=function(){return window.location.hash.substring(1)});this.fileLoaded(L);this.getCurrentFile().setModified(!this.editor.chromeless)}),E=window.opener||window.parent;if(E!=window){var F=urlParams.create;null!=F?v(E[decodeURIComponent(F)]):(F=urlParams.data,null!=F?v(decodeURIComponent(F)):this.installMessageHandler(mxUtils.bind(this,function(L,N){N.source==E&&v(L)})))}}else if(null==