Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
p+'" target="_blank"><img border="0" src="'+EditorUi.drawHost+'/images/drawlogo128.png"/></a>')+"\n</body>\n</html>\n"};EditorUi.prototype.getHtml2=function(c,e,g,q,p){e=window.DRAWIO_VIEWER_URL||EditorUi.drawHost+"/js/viewer-static.min.js";null!=p&&(p=p.replace(/&/g,"&amp;"));c={highlight:"#0000ff",nav:this.editor.graph.foldingEnabled,resize:!0,xml:Graph.zapGremlins(c),toolbar:"pages zoom layers lightbox"};null!=this.pages&&null!=this.currentPage&&(c.page=mxUtils.indexOf(this.pages,this.currentPage));
return(null==p?'\x3c!--[if IE]><meta http-equiv="X-UA-Compatible" content="IE=5,IE=9" ><![endif]--\x3e\n':"")+"<!DOCTYPE html>\n<html"+(null!=p?' xmlns="http://www.w3.org/1999/xhtml">':">")+"\n<head>\n"+(null==p?null!=g?"<title>"+mxUtils.htmlEntities(g)+"</title>\n":"":"<title>diagrams.net</title>\n")+(null!=p?'<meta http-equiv="refresh" content="0;URL=\''+p+"'\"/>\n":"")+'<meta charset="utf-8"/>\n</head>\n<body>\n<div class="mxgraph" style="max-width:100%;border:1px solid transparent;" data-mxgraph="'+
mxUtils.htmlEntities(JSON.stringify(c))+'"></div>\n'+(null==p?'<script type="text/javascript" src="'+e+'">\x3c/script>':'<a style="position:absolute;top:50%;left:50%;margin-top:-128px;margin-left:-64px;" href="'+p+'" target="_blank"><img border="0" src="'+EditorUi.drawHost+'/images/drawlogo128.png"/></a>')+"\n</body>\n</html>\n"};EditorUi.prototype.setFileData=function(c){c=this.validateFileData(c);this.pages=this.fileNode=this.currentPage=null;var e=null!=c&&0<c.length?mxUtils.parseXml(c).documentElement: