Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
f,u,null,M,O,da,null,null,l.scale,l.border);return ja};EditorUi.prototype.getXmlFileData=function(d,f,l,u){d=null!=d?d:!0;f=null!=f?f:!1;l=null!=l?l:!Editor.defaultCompressed;var A=this.editor.getGraphXml(d,u);if(d&&null!=this.fileNode&&null!=this.currentPage)if(d=function(O){var H=O.getElementsByTagName("mxGraphModel");H=0<H.length?H[0]:null;null==H&&l?(H=mxUtils.trim(mxUtils.getTextContent(O)),O=O.cloneNode(!1),0<H.length&&(H=Graph.decompress(H),null!=H&&0<H.length&&O.appendChild(mxUtils.parseXml(H).documentElement))):
null==H||l?O=O.cloneNode(!0):(O=O.cloneNode(!1),mxUtils.setTextContent(O,Graph.compressNode(H)));A.appendChild(O)},EditorUi.removeChildNodes(this.currentPage.node),mxUtils.setTextContent(this.currentPage.node,Graph.compressNode(A)),A=this.fileNode.cloneNode(!1),f)d(this.currentPage.node);else for(f=0;f<this.pages.length;f++){var B=this.pages[f],F=B.node;if(B!=this.currentPage)if(B.needsUpdate){var M=new mxCodec(mxUtils.createXmlDocument());M=M.encode(new mxGraphModel(B.root));this.editor.graph.saveViewState(B.viewState,