Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
N.spin(fa);var la=function(na,pa,ha){O=0;N.stop();Ga=na;ha=ha||{};var ka=0,ua;for(ua in ha)ka+=ha[ua].length;if(pa)fa.innerText=pa;else if(0==na.length&&0==ka)fa.innerText=mxResources.get("noDiagrams",null,"No Diagrams Found");else if(fa.innerText="",0<ka){ta.style.display="";fa.style.left="160px";ta.innerText="";Da=0;sa={"draw.io":na};for(ua in ha)sa[ua]=ha[ua];p()}else v(!0)};aa?I(Z.value,la):M(la)};M&&(q=mxUtils.button(mxResources.get("Recent",null,"Recent"),function(){Y()}),n.appendChild(q),U.push(q));