Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
O.spin(da);var la=function(ma,oa,fa){K=0;O.stop();Ha=ma;fa=fa||{};var ja=0,sa;for(sa in fa)ja+=fa[sa].length;if(oa)da.innerText=oa;else if(0==ma.length&&0==ja)da.innerText=mxResources.get("noDiagrams",null,"No Diagrams Found");else if(da.innerText="",0<ja){wa.style.display="";da.style.left="160px";wa.innerText="";Da=0;ua={"draw.io":ma};for(sa in fa)ua[sa]=fa[sa];l()}else t(!0)};aa?J(Z.value,la):R(la)};R&&(n=mxUtils.button(mxResources.get("Recent",null,"Recent"),function(){Y()}),g.appendChild(n),Q.push(n));