Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
x.parentNode.removeChild(x)}catch(I){}}else this.createEchoRequest(c,e,g,q,p).simulate(document,"_blank")}};EditorUi.prototype.createEchoRequest=function(c,e,g,q,p,t){c="xml="+encodeURIComponent(c);return new mxXmlRequest(SAVE_URL,c+(null!=g?"&mime="+g:"")+(null!=p?"&format="+p:"")+(null!=t?"&base64="+t:"")+(null!=e?"&filename="+encodeURIComponent(e):"")+(q?"&binary=1":""))};EditorUi.prototype.base64ToBlob=function(c,e){e=e||"";c=atob(c);for(var g=c.length,q=Math.ceil(g/1024),p=Array(q),t=0;t<q;++t){for(var x=
1024*t,B=Math.min(x+1024,g),I=Array(B-x),A=0;x<B;++A,++x)I[A]=c[x].charCodeAt(0);p[t]=new Uint8Array(I)}return new Blob(p,{type:e})};EditorUi.prototype.saveLocalFile=function(c,e,g,q,p,t,x,B){t=null!=t?t:!1;x=null!=x?x:"vsdx"!=p&&(!mxClient.IS_IOS||!navigator.standalone);p=this.getServiceCount(t);isLocalStorage&&p++;var I=4>=p?2:6<p?4:3;e=new CreateDialog(this,e,mxUtils.bind(this,function(A,S){try{if("_blank"==S)if(null!=g&&"image/"==g.substring(0,6))this.openInNewWindow(c,g,q);else if(null!=g&&"text/html"==