Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!1;this.graph.setEnabled(!1);1==this.graphConfig["toolbar-nohide"]&&(this.editor.defaultGraphOverflow="visible");this.xmlNode=this.editor.extractGraphModel(this.xmlNode,!0);this.xmlNode!=e&&(this.xml=mxUtils.getXml(this.xmlNode),this.xmlDocument=this.xmlNode.ownerDocument);var N=this;this.graph.getImageFromBundles=function(k){return N.getImageUrl(k)};mxClient.IS_SVG&&this.graph.addSvgShadow(this.graph.view.canvas.ownerSVGElement,null,!0);if("mxfile"==this.xmlNode.nodeName){var T=this.xmlNode.getElementsByTagName("diagram");