Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!d.isOfflineApp()&&isLocalStorage&&this.addMenuItem(l,"plugins",n),this.addMenuItems(l,["-","editDiagram"],n),this.addSubmenu("diagramLanguage",l,n),l.addSeparator(n),"1"!=urlParams.embed&&(isLocalStorage||mxClient.IS_CHROMEAPP)&&this.addMenuItems(l,["showStartScreen"],n),this.addMenuItems(l,["configuration"],n),l.addSeparator(n),"1"==urlParams.newTempDlg&&(d.actions.addAction("templates",function(){function C(M){return{id:M.id,isExt:!0,url:M.downloadUrl,title:M.title,imgUrl:M.thumbnailLink,changedBy:M.lastModifyingUserName,
lastModifiedOn:M.modifiedDate}}var D=new TemplatesDialog(d,function(M){console.log(arguments)},null,null,null,"user",function(M,K,O){var V=new Date;V.setDate(V.getDate()-7);d.drive.listFiles(null,V,O?!0:!1,function(k){for(var y=[],G=0;G<k.items.length;G++)y.push(C(k.items[G]));M(y)},K)},function(M,K,O,V){d.drive.listFiles(M,null,V?!0:!1,function(k){for(var y=[],G=0;G<k.items.length;G++)y.push(C(k.items[G]));K(y)},O)},function(M,K,O){d.drive.getFile(M.id,function(V){K(V.data)},O)},null,function(M){M({Test:[]},