Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
O.cell.id,O.text),K=!1);K||D++;M++});console.log("states checked",M,"invalid",D)}));d.actions.addAction("testCheckFile",mxUtils.bind(this,function(){var l=null!=d.pages&&null!=d.getCurrentFile()?d.getCurrentFile().getAnonymizedXmlForPages(d.pages):"";l=new TextareaDialog(d,"Paste Data:",l,function(n){if(0<n.length)try{var z=function(O){function V(Y){if(null==X[Y]){if(X[Y]=!0,null!=G[Y]){for(;0<G[Y].length;){var Z=G[Y].pop();V(Z)}delete G[Y]}}else mxLog.debug(k+": Visited: "+Y)}var k=O.parentNode.id,
y=O.childNodes;O={};for(var G={},P=null,Q={},U=0;U<y.length;U++){var T=y[U];if(null!=T.id&&0<T.id.length)if(null==O[T.id]){O[T.id]=T.id;var W=T.getAttribute("parent");null==W?null!=P?mxLog.debug(k+": Multiple roots: "+T.id):P=T.id:(null==G[W]&&(G[W]=[]),G[W].push(T.id))}else Q[T.id]=T.id}y=Object.keys(Q);0<y.length?(y=k+": "+y.length+" Duplicates: "+y.join(", "),mxLog.debug(y+" (see console)")):mxLog.debug(k+": Checked");var X={};null==P?mxLog.debug(k+": No root"):(V(P),Object.keys(X).length!=Object.keys(O).length&&
(mxLog.debug(k+": Invalid tree: (see console)"),console.log(k+": Invalid tree",G)))};"<"!=n.charAt(0)&&(n=Graph.decompress(n),mxLog.debug("See console for uncompressed XML"),console.log("xml",n));var C=mxUtils.parseXml(n),D=d.getPagesForNode(C.documentElement,"mxGraphModel");if(null!=D&&0<D.length)try{var M=d.getHashValueForPages(D);mxLog.debug("Checksum: ",M)}catch(O){mxLog.debug("Error: ",O.message)}else mxLog.debug("No pages found for checksum");var K=C.getElementsByTagName("root");for(n=0;n<K.length;n++)z(K[n]);