Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
DrawioFile.prototype.share=function(){null!=this.ui.drive?this.ui.confirm(mxResources.get("saveItToGoogleDriveToCollaborate",[this.getTitle()]),mxUtils.bind(this,function(){this.ui.pickFolder(App.MODE_GOOGLE,mxUtils.bind(this,function(b){var e=this.ui.editor.graph,g=e.getSelectionCells(),n=e.getViewState(),y=this.ui.currentPage;this.ui.createFile(this.getTitle(),this.ui.getFileData(null,null,null,null,null,null,null,null,this),null,App.MODE_GOOGLE,null,!0,b,null,null,mxUtils.bind(this,function(){this.ui.restoreViewState(y,
n,g);this.ui.actions.get("share").funct()}))}))}),null,mxResources.get("saveToGoogleDrive",null,"Save to Google Drive"),mxResources.get("cancel")):this.ui.alert(mxResources.get("sharingAvailable"),null,380)};DrawioFile.prototype.getHash=function(){return""};DrawioFile.prototype.getId=function(){return""};DrawioFile.prototype.isEditable=function(){return!this.ui.editor.isChromelessView()||this.ui.editor.editable};DrawioFile.prototype.getUi=function(){return this.ui};DrawioFile.prototype.getTitle=function(){return""};