Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
y,G,P){for(var Q=0;Q<P;Q++)k=Editor.crcTable[(k^y.charCodeAt(G+Q))&255]^k>>>8;return k};Editor.crc32=function(k){for(var y=-1,G=0;G<k.length;G++)y=y>>>8^Editor.crcTable[(y^k.charCodeAt(G))&255];return(y^-1)>>>0};Editor.writeGraphModelToPng=function(k,y,G,P,Q){function U(Z,ca){var ha=X;X+=ca;return Z.substring(ha,X)}function T(Z){Z=U(Z,4);return Z.charCodeAt(3)+(Z.charCodeAt(2)<<8)+(Z.charCodeAt(1)<<16)+(Z.charCodeAt(0)<<24)}function W(Z){return String.fromCharCode(Z>>24&255,Z>>16&255,Z>>8&255,Z&255)}
k=k.substring(k.indexOf(",")+1);k=window.atob?atob(k):Base64.decode(k,!0);var X=0;if(U(k,8)!=String.fromCharCode(137)+"PNG"+String.fromCharCode(13,10,26,10))null!=Q&&Q();else if(U(k,4),"IHDR"!=U(k,4))null!=Q&&Q();else{U(k,17);Q=k.substring(0,X);do{var Y=T(k);if("IDAT"==U(k,4)){Q=k.substring(0,X-8);"pHYs"==y&&"dpi"==G?(G=Math.round(P/.0254),G=W(G)+W(G)+String.fromCharCode(1)):G=G+String.fromCharCode(0)+("zTXt"==y?String.fromCharCode(0):"")+P;P=4294967295;P=Editor.updateCRC(P,y,0,4);P=Editor.updateCRC(P,
G,0,G.length);Q+=W(G.length)+y+G+W(P^4294967295);Q+=k.substring(X-8,k.length);break}Q+=k.substring(X-8,X-4+Y);U(k,Y);U(k,4)}while(Y);return"data:image/png;base64,"+(window.btoa?btoa(Q):Base64.encode(Q,!0))}};if(window.ColorDialog){FilenameDialog.filenameHelpLink="https://www.drawio.com/doc/faq/save-file-formats";var F=ColorDialog.addRecentColor;ColorDialog.addRecentColor=function(k,y){F.apply(this,arguments);mxSettings.setRecentColors(ColorDialog.recentColors);mxSettings.save()};var L=ColorDialog.resetRecentColors;