Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
O.length&&(P=O[Math.max(0,Math.min(O.length-1,urlParams.page||0))])),null!=P&&(g=Editor.parseDiagramNode(P,H)));null==g||"mxGraphModel"==g.nodeName||y&&"mxfile"==g.nodeName||(g=null);return g};Editor.parseDiagramNode=function(g,y){var H=mxUtils.trim(mxUtils.getTextContent(g)),O=null;0<H.length?(g=Graph.decompress(H,null,y),null!=g&&0<g.length&&(O=mxUtils.parseXml(g).documentElement)):(g=mxUtils.getChildNodes(g),0<g.length&&(O=mxUtils.createXmlDocument(),O.appendChild(O.importNode(g[0],!0)),O=O.documentElement));
return O};Editor.getDiagramNodeXml=function(g){var y=mxUtils.getTextContent(g),H=null;0<y.length?H=Graph.decompress(y):null!=g.firstChild&&(H=mxUtils.getXml(g.firstChild));return H};Editor.extractGraphModelFromPdf=function(g){g=g.substring(g.indexOf(",")+1);g=window.atob&&!mxClient.IS_SF?atob(g):Base64.decode(g,!0);if("%PDF-1.7"==g.substring(0,8)){var y=g.indexOf("EmbeddedFile");if(-1<y){var H=g.indexOf("stream",y)+9;if(0<g.substring(y,H).indexOf("application#2Fvnd.jgraph.mxfile"))return y=g.indexOf("endstream",