Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
GitHubFile.prototype.saveFile=function(b,e,f,c,k,l,x){if(this.isEditable())if(this.savingFile)null!=c&&c({code:App.ERROR_BUSY});else{var y=mxUtils.bind(this,function(E){if(this.getTitle()==b)try{this.savingFileTime=new Date;this.setShadowModified(!1);this.savingFile=!0;var D=this.getCurrentEtag(),z=this.data;this.peer.saveFile(this,mxUtils.bind(this,function(M){this.setModified(this.getShadowModified());this.savingFile=!1;this.setDescriptorEtag(this.meta,M);this.fileSaved(z,D,mxUtils.bind(this,function(){this.contentChanged();
null!=f&&f()}),c)}),mxUtils.bind(this,function(M){this.savingFile=!1;this.isConflict(M)?(this.inConflictState=!0,null!=c&&c({commitMessage:E})):null!=c&&c(M)}),l,E)}catch(M){if(this.savingFile=!1,null!=c)c(M);else throw M;}else this.savingFileTime=new Date,this.setShadowModified(!1),this.savingFile=!0,this.ui.pickFolder(this.getMode(),mxUtils.bind(this,function(M){this.peer.insertFile(b,this.getData(),mxUtils.bind(this,function(I){this.setModified(this.getShadowModified());this.savingFile=!1;null!=
f&&f();this.ui.fileLoaded(I)}),mxUtils.bind(this,function(){this.savingFile=!1;null!=c&&c()}),!1,M,E)}))});null!=x?y(x):this.peer.showCommitDialog(this.meta.name,null==this.getDescriptorEtag(this.meta)||this.meta.isNew,mxUtils.bind(this,function(E){y(E)}),c)}else null!=f&&f()};GitHubLibrary=function(b,e,f){GitHubFile.call(this,b,e,f)};mxUtils.extend(GitHubLibrary,GitHubFile);GitHubLibrary.prototype.doSave=function(b,e,f){this.saveFile(b,!1,e,f)};GitHubLibrary.prototype.open=function(){};(function(){var b=null;window.GitHubClient=function(e,f){DrawioClient.call(this,e,f||"ghauth")};mxUtils.extend(GitHubClient,DrawioClient);GitHubClient.prototype.clientId="test.draw.io"==window.location.hostname?"Iv1.1218f5567fbc258a":window.DRAWIO_GITHUB_ID;GitHubClient.prototype.extension=".drawio";GitHubClient.prototype.baseUrl=DRAWIO_GITHUB_API_URL;GitHubClient.prototype.baseHostUrl=DRAWIO_GITHUB_URL;GitHubClient.prototype.redirectUri=window.location.protocol+"//"+window.location.host+"/github2";