Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null,G),0<P.length&&(k=mxUtils.parseXml(P),k=k.documentElement))))}if(null!=k&&"svg"==k.nodeName)if(P=k.getAttribute("content"),null!=P&&"<"!=P.charAt(0)&&"%"!=P.charAt(0)&&(P=unescape(window.atob?atob(P):Base64.decode(cont,P))),null!=P&&"%"==P.charAt(0)&&(P=decodeURIComponent(P)),null!=P&&0<P.length)k=mxUtils.parseXml(P).documentElement;else throw{message:mxResources.get("notADiagramFile")};null==k||y||(Q=null,"diagram"==k.nodeName?Q=k:"mxfile"==k.nodeName&&(P=k.getElementsByTagName("diagram"),0<
P.length&&(Q=P[Math.max(0,Math.min(P.length-1,urlParams.page||0))])),null!=Q&&(k=Editor.parseDiagramNode(Q,G)));null==k||"mxGraphModel"==k.nodeName||y&&"mxfile"==k.nodeName||(k=null);return k};Editor.parseDiagramNode=function(k,y){var G=mxUtils.trim(mxUtils.getTextContent(k)),P=null;0<G.length?(k=Graph.decompress(G,null,y),null!=k&&0<k.length&&(P=mxUtils.parseXml(k).documentElement)):(k=mxUtils.getChildNodes(k),0<k.length&&(P=mxUtils.createXmlDocument(),P.appendChild(P.importNode(k[0],!0)),P=P.documentElement));