Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
B,K,R){for(var U=0;U<R;U++)m=Editor.crcTable[(m^B.charCodeAt(K+U))&255]^m>>>8;return m};Editor.crc32=function(m){for(var B=-1,K=0;K<m.length;K++)B=B>>>8^Editor.crcTable[(B^m.charCodeAt(K))&255];return(B^-1)>>>0};Editor.writeGraphModelToPng=function(m,B,K,R,U){function W(Z,ca){var da=X;X+=ca;return Z.substring(da,X)}function Q(Z){Z=W(Z,4);return Z.charCodeAt(3)+(Z.charCodeAt(2)<<8)+(Z.charCodeAt(1)<<16)+(Z.charCodeAt(0)<<24)}function V(Z){return String.fromCharCode(Z>>24&255,Z>>16&255,Z>>8&255,Z&255)}
m=m.substring(m.indexOf(",")+1);m=window.atob?atob(m):Base64.decode(m,!0);var X=0;if(W(m,8)!=String.fromCharCode(137)+"PNG"+String.fromCharCode(13,10,26,10))null!=U&&U();else if(W(m,4),"IHDR"!=W(m,4))null!=U&&U();else{W(m,17);U=m.substring(0,X);do{var Y=Q(m);if("IDAT"==W(m,4)){U=m.substring(0,X-8);"pHYs"==B&&"dpi"==K?(K=Math.round(R/.0254),K=V(K)+V(K)+String.fromCharCode(1)):K=K+String.fromCharCode(0)+("zTXt"==B?String.fromCharCode(0):"")+R;R=4294967295;R=Editor.updateCRC(R,B,0,4);R=Editor.updateCRC(R,
K,0,K.length);U+=V(K.length)+B+K+V(R^4294967295);U+=m.substring(X-8,m.length);break}U+=m.substring(X-8,X-4+Y);W(m,Y);W(m,4)}while(Y);return"data:image/png;base64,"+(window.btoa?btoa(U):Base64.encode(U,!0))}};if(window.ColorDialog){FilenameDialog.filenameHelpLink="https://www.drawio.com/doc/faq/save-file-formats";var y=ColorDialog.addRecentColor;ColorDialog.addRecentColor=function(m,B){y.apply(this,arguments);mxSettings.setRecentColors(ColorDialog.recentColors);mxSettings.save()};var E=ColorDialog.resetRecentColors;