Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!1,!1),c.pdfPageExport||mxEvent.addListener(R,"change",J);J=!mxClient.IS_CHROMEAPP&&!EditorUi.isElectronApp&&"draw.io"==c.getServiceName();var Q=null,V=null;if(EditorUi.isElectronApp||J)V=c.addCheckbox(q,mxResources.get("includeCopyOfMyDiagram"),Editor.defaultIncludeDiagram),C+=30;J&&(Q=c.addCheckbox(q,mxResources.get("transparentBackground"),!1),C+=30);q=new CustomDialog(c,q,mxUtils.bind(this,function(){var X=null;if(!p){X=parseInt(m.value);var Y=parseInt(K.value);X=N.checked||X==P&&Y==P?null:{from:Math.max(0,
Math.min(G-1,X-1)),to:Math.max(0,Math.min(G-1,Y-1))}}c.downloadFile("pdf",null,null,!R.checked,p?!0:!N.checked&&null==X,!U.checked,null!=Q&&Q.checked,null,null,W.checked,null!=V&&V.checked,X)}),null,mxResources.get("export"));c.showDialog(q.container,300,C,!0,!0)}else c.showDialog((new PrintDialog(c,mxResources.get("formatPdf"))).container,360,null!=c.pages&&1<c.pages.length&&(c.editor.editable||"1"!=urlParams["hide-pages"])?470:390,!0,!0)}));c.actions.addAction("open...",function(){c.pickFile()});