Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.timeout),B=mxUtils.bind(this,function(){window.clearTimeout(x);t&&q.apply(this,arguments)}),I=mxUtils.bind(this,function(){window.clearTimeout(x);t&&p.apply(this,arguments)});g=g||{};g.callbackId=this.remoteInvokeCallbacks.length;this.remoteInvokeCallbacks.push({callback:B,error:I});c=JSON.stringify({event:"remoteInvoke",funtionName:c,functionArgs:e,msgMarkers:g});null!=this.remoteWin?this.remoteWin.postMessage(c,"*"):this.remoteInvokeQueue.push(c)};EditorUi.prototype.handleRemoteInvoke=function(c,
e){var g=mxUtils.bind(this,function(A,S){var l={event:"remoteInvokeResponse",msgMarkers:c.msgMarkers};null!=S?l.error={errResp:S}:null!=A&&(l.resp=A);this.remoteWin.postMessage(JSON.stringify(l),"*")});try{var q=c.funtionName,p=this.remoteInvokableFns[q];if(null!=p&&"function"===typeof this[q]){if(p.allowedDomains){for(var t=!1,x=0;x<p.allowedDomains.length;x++)if(e=="https://"+p.allowedDomains[x]){t=!0;break}if(!t){g(null,"Invalid Call: "+q+" is not allowed.");return}}var B=c.functionArgs;Array.isArray(B)||
(B=[]);if(p.isAsync)B.push(function(){g(Array.prototype.slice.apply(arguments))}),B.push(function(A){g(null,A||"Unkown Error")}),this[q].apply(this,B);else{var I=this[q].apply(this,B);g([I])}}else g(null,"Invalid Call: "+q+" is not found.")}catch(A){g(null,"Invalid Call: An error occurred, "+A.message)}};EditorUi.prototype.openDatabase=function(c,e){if(null==this.database){var g=window.indexedDB||window.mozIndexedDB||window.webkitIndexedDB;if(null!=g)try{var q=g.open("database",2);q.onupgradeneeded=