Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(e,f){try{var c=JSON.parse(e.getText());null!=c&&null!=c.message&&(f=c.message)}catch(k){}return f};GitHubClient.prototype.showAuthorizeDialog=function(e,f){this.ui.showError(mxResources.get("accessDenied"),mxResources.get("authorizationRequired"),mxResources.get("help"),mxUtils.bind(this,function(){this.ui.openLink("https://www.drawio.com/blog/single-repository-diagrams")}),e,mxResources.get("authorize"),mxUtils.bind(this,function(){this.ui.openLink("test.draw.io"==window.location.hostname?
"https://github.com/apps/diagrams-net-app-test":"https://github.com/apps/draw-io-app")}),mxResources.get("cancel"),f,480,null,!1)};GitHubClient.prototype.executeRequest=function(e,f,c,k,l){var x=mxUtils.bind(this,function(E){var D=!0,z=window.setTimeout(mxUtils.bind(this,function(){D=!1;c({code:App.ERROR_TIMEOUT,retry:y})}),this.ui.timeout),M=this.authToken+" "+b;e.setRequestHeaders=function(I,d){I.setRequestHeader("Authorization",M)};e.send(mxUtils.bind(this,function(){window.clearTimeout(z);var I=