Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
J:this.emptyDiagramXml,null!=urlParams.title?decodeURIComponent(urlParams.title):this.defaultFilename,!0);H.getHash=function(){return v};this.fileLoaded(H);"csv"==d.format&&this.importCsv(J,mxUtils.bind(this,function(ca){this.editor.undoManager.clear();this.editor.setModified(!1);this.editor.setStatus("")}));if(null!=d.update){var O=null!=d.interval?parseInt(d.interval):6E4,G=null,ja=mxUtils.bind(this,function(){var ca=this.currentPage;mxUtils.post(d.update,"xml="+encodeURIComponent(mxUtils.getXml(this.editor.getGraphXml())),