Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var GoogleSitesDialog=function(b,f){function m(){var T=null!=B&&null!=B.getTitle()?B.getTitle():this.defaultFilename;if(C.checked&&""!=J.value){var l="https://www.draw.io/gadget.xml?type=4&diagram="+encodeURIComponent(mxUtils.htmlEntities(J.value));null!=T&&(l+="&title="+encodeURIComponent(T));0<I.length&&(l+="&s="+I);""!=c.value&&"0"!=c.value&&(l+="&border="+c.value);""!=S.value&&(l+="&height="+S.value);l+="&pan="+(e.checked?"1":"0");l+="&zoom="+(k.checked?"1":"0");l+="&fit="+(x.checked?"1":"0");
l+="&resize="+(t.checked?"1":"0");l+="&x0="+Number(G.value);l+="&y0="+K;u.mathEnabled&&(l+="&math=1");p.checked?l+="&edit=_blank":q.checked&&(l+="&edit="+encodeURIComponent(mxUtils.htmlEntities(window.location.href)));M.value=l}else B.constructor==DriveFile||B.constructor==DropboxFile?(l="https://www.draw.io/gadget.xml?embed=0&diagram=",""!=J.value?l+=encodeURIComponent(mxUtils.htmlEntities(J.value))+"&type=3":(l+=B.getHash().substring(1),l=B.constructor==DropboxFile?l+"&type=2":l+"&type=1"),null!=
T&&(l+="&title="+encodeURIComponent(T)),""!=S.value&&(T=parseInt(S.value)+parseInt(G.value),l+="&height="+T),M.value=l):M.value=""}var d=document.createElement("div"),u=b.editor.graph,v=u.getGraphBounds(),D=u.view.scale,F=Math.floor(v.x/D-u.view.translate.x),K=Math.floor(v.y/D-u.view.translate.y);mxUtils.write(d,mxResources.get("googleGadget")+":");mxUtils.br(d);var M=document.createElement("input");M.setAttribute("type","text");M.style.marginBottom="8px";M.style.marginTop="2px";M.style.width="410px";