Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
DrawioFile.prototype.redirectToNewApp=function(b,e){this.ui.spinner.stop();if(!this.redirectDialogShowing){this.redirectDialogShowing=!0;var g=window.location.protocol+"//"+window.location.host+"/"+this.ui.getSearch("create title mode url drive splash state".split(" "))+"#"+this.getHash(),n=mxResources.get("redirectToNewApp");null!=e&&(n+=" ("+e+")");e=mxUtils.bind(this,function(){var y=mxUtils.bind(this,function(){this.redirectDialogShowing=!1;window.location.href==g?window.location.reload():window.location.href=
g});null==b&&this.isModified()?this.ui.confirm(mxResources.get("allChangesLost"),mxUtils.bind(this,function(){this.redirectDialogShowing=!1}),y,mxResources.get("cancel"),mxResources.get("discardChanges")):y()});null!=b?this.isModified()?this.ui.confirm(n,mxUtils.bind(this,function(){this.redirectDialogShowing=!1;b()}),e,mxResources.get("cancel"),mxResources.get("discardChanges")):this.ui.confirm(n,e,mxUtils.bind(this,function(){this.redirectDialogShowing=!1;b()})):this.ui.alert(mxResources.get("redirectToNewApp"),
e)}};