Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
DrawioFile.prototype.handleConflictError=function(b,f){var m=mxUtils.bind(this,function(){this.handleFileSuccess(!0)}),d=mxUtils.bind(this,function(E){this.handleFileError(E,!0)}),u=mxUtils.bind(this,function(){this.ui.spinner.spin(document.body,mxResources.get(this.savingSpinnerKey))&&(this.ui.editor.setStatus(""),this.save(!0,m,d,null,!0,this.constructor!=GitHubFile&&this.constructor!=GitLabFile||null==b?null:b.commitMessage))}),v=mxUtils.bind(this,function(){this.ui.spinner.spin(document.body,mxResources.get("updatingDocument"))&&
this.synchronizeFile(mxUtils.bind(this,function(){this.ui.spinner.stop();this.ui.spinner.spin(document.body,mxResources.get(this.savingSpinnerKey))&&this.save(!0,m,d,null,null,this.constructor!=GitHubFile&&this.constructor!=GitLabFile||null==b?null:b.commitMessage)}),d)});"none"==DrawioFile.SYNC?this.showCopyDialog(m,d,u):this.invalidChecksum?this.showRefreshDialog(m,d,this.getErrorMessage(b)):f?this.showConflictDialog(u,v):this.addConflictStatus(this.getErrorMessage(b),mxUtils.bind(this,function(){this.ui.editor.setStatus(mxUtils.htmlEntities(mxResources.get("updatingDocument")));
this.synchronizeFile(m,d)}))};DrawioFile.prototype.getErrorMessage=function(b){var f=null!=b?null!=b.error?b.error.message:b.message:null;null==f&&null!=b&&b.code==App.ERROR_TIMEOUT?f=mxResources.get("timeout"):"0"==f&&(f=mxResources.get("noResponse"));return f};DrawioFile.prototype.isOverdue=function(){return null!=this.ageStart&&Date.now()-this.ageStart.getTime()>=this.ui.warnInterval};