Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
C&&(C=/.* \/Info (\d+) (\d+) R/g.exec(C.join("\n")),null!=C&&0<C.length&&(C=m[C[1]],null!=C&&(C=/.* \/Subject (\d+) (\d+) R/g.exec(C.join("\n")),null!=C&&0<C.length&&(m=m[C[1]],null!=m&&(m=m.join("\n"),M=m.substring(1,m.length-1))))));return M};Editor.extractParserError=function(m,C){var M=null;m=null!=m?m.getElementsByTagName("parsererror"):null;null!=m&&0<m.length&&(M=C||mxResources.get("invalidChars"),C=m[0].getElementsByTagName("div"),0<C.length&&(M=mxUtils.getTextContent(C[0])));return null!=
M?mxUtils.trim(M):M};Editor.addRetryToError=function(m,C){null!=m&&(m=null!=m.error?m.error:m,null==m.retry&&(m.retry=C))};Editor.mermaidToDrawio=function(m,C,M){if("function"===typeof mxMermaidToDrawio)return mxMermaidToDrawio(m,C,M)};Editor.configure=function(m){if(null!=m){Editor.config=m;Editor.configVersion=m.version;m.debug&&(urlParams.test="1");null!=m.defaultFonts&&(Menus.prototype.defaultFonts=m.defaultFonts);null!=m.presetColors&&(ColorDialog.prototype.presetColors=m.presetColors);null!=