Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
DrawioFile.prototype.save=function(b,f,m,d,u,v){try{if(EditorUi.debug("DrawioFile.save",[this],"revision",b,"unloading",d,"overwrite",u,"manual",v,"saving",this.savingFile,"editable",this.isEditable(),"invalidChecksum",this.invalidChecksum),this.isEditable())if(!u&&this.invalidChecksum)if(null!=m)m({message:mxResources.get("checksum")});else throw Error(mxResources.get("checksum"));else this.updateFileData(),this.clearAutosave(),null!=f&&f();else if(null!=m)m({message:mxResources.get("readOnly")});
else throw Error(mxResources.get("readOnly"));}catch(E){if(null!=m)m(E);else throw E;}};DrawioFile.prototype.createData=function(){var b=this.ui.pages;if(this.isRealtime()&&(this.ui.pages=this.ownPages,null!=this.ui.currentPage)){var f=this.ui.getPageById(this.ui.currentPage.getId(),this.ownPages);null!=f&&(f.viewState=this.ui.editor.graph.getViewState(),f.needsUpdate=!0)}f=this.ui.getFileData(null,null,null,null,null,null,null,null,this,!this.isCompressed());this.ui.pages=b;return f};