Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
D){return new mxXmlRequest(EXPORT_URL,"format="+g+"&base64="+(D||"0")+(null!=C?"&filename="+encodeURIComponent(C):"")+"&extras="+encodeURIComponent(JSON.stringify(z))+(0<x?"&dpi="+x:"")+"&bg="+(null!=q?q:"none")+"&w="+l+"&h="+n+"&border="+t+"&xml="+encodeURIComponent(A))})}else"png"==g?c.exportImage(p,null==q||"none"==q,!0,!1,!1,t,!0,!1,null,B,x):c.exportImage(p,!1,!0,!1,!1,t,!0,!1,"jpeg",B);else mxUtils.alert(mxResources.get("drawingTooLarge"))}});EditorUi.prototype.getDiagramTextContent=function(){this.editor.graph.setEnabled(!1);
var c=this.editor.graph,e="";if(null!=this.pages)for(var g=0;g<this.pages.length;g++){var q=c;this.currentPage!=this.pages[g]&&(q=this.createTemporaryGraph(c.getStylesheet()),this.updatePageRoot(this.pages[g]),q.model.setRoot(this.pages[g].root));e+=this.pages[g].getName()+" "+q.getIndexableText()+" "}else e=c.getIndexableText();this.editor.graph.setEnabled(!0);return e};EditorUi.prototype.showRemotelyStoredLibrary=function(c){var e={},g=document.createElement("div");g.style.whiteSpace="nowrap";var q=