Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Aa?ka.getName():"pagenumber"==Aa?ha+1:"pagecount"==Aa?null!=m.pages?m.pages.length:1:Ia.apply(this,arguments)};document.body.appendChild(ja.container);m.updatePageRoot(ka);ja.model.setRoot(ka.root)}na=Fa(ja,na,ha!=la,ka.getId());ja!=U&&ja.container.parentNode.removeChild(ja.container)}}else na=Fa(U);null==na?m.handleError({message:mxResources.get("errorUpdatingPreview")}):(na.mathEnabled&&(la=na.wnd.document,Qa&&(na.wnd.IMMEDIATE_PRINT=!0),la.writeln('<script type="text/javascript" src="'+DRAWIO_BASE_URL+
'/js/math-print.js">\x3c/script>')),na.closeDocument(),Graph.rewritePageLinks(na.wnd.document),!na.mathEnabled&&Qa&&PrintDialog.printPreview(na));null!=Ga&&(U.shapeForegroundColor=Va,U.shapeBackgroundColor=Ua,U.stylesheet=Ga,U.refresh())}}var U=m.editor.graph,W=document.createElement("div"),Q=document.createElement("h3");Q.style.width="100%";Q.style.textAlign="center";Q.style.marginTop="0px";mxUtils.write(Q,B||mxResources.get("print"));W.appendChild(Q);var V=1,X=1;Q=document.createElement("div");