Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
f.style.verticalAlign="middle";f.className="geBtn";v.appendChild(f);b.isOffline()&&!mxClient.IS_CHROMEAPP&&(f.style.display="none");f=mxUtils.button(mxResources.get("cancel"),function(){b.hideDialog()});f.style.verticalAlign="middle";f.className="geBtn";b.editor.cancelFirst&&v.appendChild(f);LinkDialog.selectedDocs=null;LinkDialog.filePicked=function(A){if(A.action==google.picker.Action.PICKED){LinkDialog.selectedDocs=A.docs;var H=A.docs[0].url;"application/mxe"==A.docs[0].mimeType||null!=A.docs[0].mimeType&&
"application/vnd.jgraph."==A.docs[0].mimeType.substring(0,23)?H="https://www.draw.io/#G"+A.docs[0].id:"application/vnd.google-apps.folder"==A.docs[0].mimeType&&(H="https://drive.google.com/#folders/"+A.docs[0].id);z.value=H;z.focus()}else LinkDialog.selectedDocs=null;z.focus()};"undefined"!=typeof google&&"undefined"!=typeof google.picker&&null!=b.drive&&y(IMAGE_PATH+"/google-drive-logo.svg",mxResources.get("googlePlus"),function(){b.spinner.spin(document.body,mxResources.get("authorizing"))&&b.drive.checkToken(mxUtils.bind(this,