Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
x,null,null,null,t)):mxscript("js/extensions.min.js",x,null,null,null,t))};EditorUi.prototype.generatePlantUmlImage=function(c,e,g,q){function p(B,I,A){c1=B>>2;c2=(B&3)<<4|I>>4;c3=(I&15)<<2|A>>6;c4=A&63;r="";r+=t(c1&63);r+=t(c2&63);r+=t(c3&63);return r+=t(c4&63)}function t(B){if(10>B)return String.fromCharCode(48+B);B-=10;if(26>B)return String.fromCharCode(65+B);B-=26;if(26>B)return String.fromCharCode(97+B);B-=26;return 0==B?"-":1==B?"_":"?"}var x=new XMLHttpRequest;x.open("GET",("txt"==e?PLANT_URL+
"/txt/":"png"==e?PLANT_URL+"/png/":PLANT_URL+"/svg/")+function(B){r="";for(i=0;i<B.length;i+=3)r=i+2==B.length?r+p(B.charCodeAt(i),B.charCodeAt(i+1),0):i+1==B.length?r+p(B.charCodeAt(i),0,0):r+p(B.charCodeAt(i),B.charCodeAt(i+1),B.charCodeAt(i+2));return r}(Graph.arrayBufferToString(pako.deflateRaw(c))),!0);"txt"!=e&&(x.responseType="blob");x.onload=function(B){if(200<=this.status&&300>this.status)if("txt"==e)g(this.response);else{var I=new FileReader;I.readAsDataURL(this.response);I.onloadend=function(A){var S=
new Image;S.onload=function(){try{var l=S.width,n=S.height;if(0==l&&0==n){var z=I.result,C=z.indexOf(","),D=decodeURIComponent(escape(atob(z.substring(C+1)))),M=mxUtils.parseXml(D).getElementsByTagName("svg");0<M.length&&(l=parseFloat(M[0].getAttribute("width")),n=parseFloat(M[0].getAttribute("height")))}g(I.result,l,n)}catch(K){q(K)}};S.src=I.result};I.onerror=function(A){q(A)}}else q(B)};x.onerror=function(B){q(B)};x.send()};EditorUi.prototype.insertAsPreText=function(c,e,g){var q=this.editor.graph,