Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null!=d&&null!=d.getTitle()&&d.getTitle()!=this.defaultFilename&&O.push("title="+encodeURIComponent(d.getTitle()));G&&1<k.length&&(O.push("open="+k.substring(1)),k="");return(v&&"1"!=urlParams.dev?EditorUi.lightboxHost:mxClient.IS_CHROMEAPP||EditorUi.isElectronApp||!/.*\.draw\.io$/.test(window.location.hostname)?EditorUi.drawHost:"https://"+window.location.host)+"/"+(0<O.length?"?"+O.join("&"):"")+k};EditorUi.prototype.createHtml=function(d,f,k,v,z,A,H,J,O,G,ja,fa){this.getBasenames();var ca={};""!=
z&&z!=mxConstants.NONE&&(ca.highlight=z);"auto"!==v&&(ca.target=v);G||(ca.lightbox=!1);ca.nav=this.editor.graph.foldingEnabled;k=parseInt(k);isNaN(k)||100==k||(ca.zoom=k/100);k=[];H&&(k.push("pages"),ca.resize=!0,null!=this.pages&&null!=this.currentPage&&(ca.page=mxUtils.indexOf(this.pages,this.currentPage)));f&&(k.push("zoom"),ca.resize=!0);J&&k.push("layers");O&&k.push("tags");0<k.length&&(G&&k.push("lightbox"),ca.toolbar=k.join(" "));null!=ja&&0<ja.length&&(ca.edit=ja);null!=d?ca.url=d:ca.xml=
this.getFileData(!0,null,null,null,null,!H);f='<div class="mxgraph" style="'+(A?"max-width:100%;":"")+(""!=k?"border:1px solid transparent;":"")+'" data-mxgraph="'+mxUtils.htmlEntities(JSON.stringify(ca))+'"></div>';d=null!=d?"&fetch="+encodeURIComponent(d):"";fa(f,'<script type="text/javascript" src="'+(0<d.length?("1"==urlParams.dev?"https://test.draw.io/embed2.js?dev=1":EditorUi.lightboxHost+"/embed2.js?")+d:"1"==urlParams.dev?"https://test.draw.io/js/viewer-static.min.js":window.DRAWIO_VIEWER_URL?
window.DRAWIO_VIEWER_URL:EditorUi.lightboxHost+"/js/viewer-static.min.js")+'">\x3c/script>')};EditorUi.prototype.showHtmlDialog=function(d,f,k,v){var z=document.createElement("div");z.style.whiteSpace="nowrap";var A=document.createElement("h3");mxUtils.write(A,mxResources.get("html"));A.style.cssText="width:100%;text-align:center;margin-top:0px;margin-bottom:12px";z.appendChild(A);var H=document.createElement("div");H.style.cssText="border-bottom:1px solid lightGray;padding-bottom:8px;margin-bottom:12px;";