Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
window.DRAWIO_LOG_URL:"";(new Image).src=e+"/images/1x1.png?v="+encodeURIComponent(EditorUi.VERSION)+(null!=c?"&data="+encodeURIComponent(JSON.stringify(c)):"")}catch(g){}};EditorUi.sendReport=function(c,e){if("1"==urlParams.dev)EditorUi.debug("sendReport",c);else if(EditorUi.enableLogging)try{e=null!=e?e:5E4,c.length>e&&(c=c.substring(0,e)+"\n...[SHORTENED]"),mxUtils.post("/email","version="+encodeURIComponent(EditorUi.VERSION)+"&url="+encodeURIComponent(window.location.href)+"&data="+encodeURIComponent(c))}catch(g){}};