Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ka=="/Subject (%3Cmxfile".charCodeAt(ba)?ba++:ba=0;if(19==ba){var qa=m.indexOf("%3C%2Fmxfile%3E)",V)+15;V-=9;if(qa>V){M=m.substring(V,qa);break}}10==ka&&("endobj"==C?aa=null:"obj"==C.substring(C.length-3,C.length)||"xref"==C||"trailer"==C?(aa=[],Z[C.split(" ")[0]]=aa):null!=aa&&aa.push(C),C="")}null==M&&(M=Editor.extractGraphModelFromXref(Z));null!=M&&(M=decodeURIComponent(M.replace(/\\\(/g,"(").replace(/\\\)/g,")")));return M};Editor.extractGraphModelFromXref=function(m){var C=m.trailer,M=null;null!=
C&&(C=/.* \/Info (\d+) (\d+) R/g.exec(C.join("\n")),null!=C&&0<C.length&&(C=m[C[1]],null!=C&&(C=/.* \/Subject (\d+) (\d+) R/g.exec(C.join("\n")),null!=C&&0<C.length&&(m=m[C[1]],null!=m&&(m=m.join("\n"),M=m.substring(1,m.length-1))))));return M};Editor.extractParserError=function(m,C){var M=null;m=null!=m?m.getElementsByTagName("parsererror"):null;null!=m&&0<m.length&&(M=C||mxResources.get("invalidChars"),C=m[0].getElementsByTagName("div"),0<C.length&&(M=mxUtils.getTextContent(C[0])));return null!=