Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
g[n].parentNode&&"root"!=g[n].parentNode.nodeName&&null!=g[n].parentNode.parentNode&&(g[n].setAttribute("id",g[n].parentNode.getAttribute("id")),g[n].parentNode.parentNode.replaceChild(g[n],g[n].parentNode));return d};EditorUi.prototype.synchronizeCurrentFile=function(d){var g=this.getCurrentFile();null!=g&&(g.savingFile?this.handleError({message:mxResources.get("busy")}):!d&&g.invalidChecksum?g.handleFileError(null,!0):this.spinner.spin(document.body,mxResources.get("updatingDocument"))&&(g.clearAutosave(),
this.editor.setStatus(""),d?g.reloadFile(mxUtils.bind(this,function(){g.handleFileSuccess("manual"==DrawioFile.SYNC)}),mxUtils.bind(this,function(n){g.handleFileError(n,!0)})):g.synchronizeFile(mxUtils.bind(this,function(){g.handleFileSuccess("manual"==DrawioFile.SYNC)}),mxUtils.bind(this,function(n){g.handleFileError(n,!0)}))))};EditorUi.prototype.getFileData=function(d,g,n,t,u,v,A,H,L,F,S){u=null!=u?u:!0;v=null!=v?v:!1;F=null!=F?F:!Editor.defaultCompressed;var p=this.editor.graph;if(g||!d&&null!=