Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
G){return new mxXmlRequest(EXPORT_URL,"format="+n+"&base64="+(G||"0")+(null!=J?"&filename="+encodeURIComponent(J):"")+"&extras="+encodeURIComponent(JSON.stringify(C))+(0<A?"&dpi="+A:"")+"&bg="+(null!=t?t:"none")+"&w="+p+"&h="+q+"&border="+v+"&xml="+encodeURIComponent(F))})}else"png"==n?d.exportImage(u,null==t||"none"==t,!0,!1,!1,v,!0,!1,null,H,A):d.exportImage(u,!1,!0,!1,!1,v,!0,!1,"jpeg",H);else mxUtils.alert(mxResources.get("drawingTooLarge"))}});EditorUi.prototype.getDiagramTextContent=function(){this.editor.graph.setEnabled(!1);
var d=this.editor.graph,g="";if(null!=this.pages)for(var n=0;n<this.pages.length;n++){var t=d;this.currentPage!=this.pages[n]&&(t=this.createTemporaryGraph(d.getStylesheet()),this.updatePageRoot(this.pages[n]),t.model.setRoot(this.pages[n].root));g+=this.pages[n].getName()+" "+t.getIndexableText()+" "}else g=d.getIndexableText();this.editor.graph.setEnabled(!0);return g};EditorUi.prototype.showRemotelyStoredLibrary=function(d){var g={},n=document.createElement("div");n.style.whiteSpace="nowrap";var t=