Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null;if(null!=U){var Y=U.indexOf(",");if(0<Y)for(U=U.substring(Y+1),Q=Q.getProperty("patches"),Y=0;Y<Q.length;Y++)if(null!=Q[Y][EditorUi.DIFF_UPDATE]&&null!=Q[Y][EditorUi.DIFF_UPDATE][U]||null!=Q[Y][EditorUi.DIFF_REMOVE]&&0<=mxUtils.indexOf(Q[Y][EditorUi.DIFF_REMOVE],U)){f.refreshBackgroundImage();break}}}));var A=f.getBackgroundImageObject;f.getBackgroundImageObject=function(U,Q){var Y=A.apply(this,arguments);if(null!=Y&&null!=Y.originalSrc)if(!Q)Y={src:Y.originalSrc};else if(Q&&null!=this.themes&&
"darkTheme"==this.defaultThemeName){var m=this.stylesheet,C=this.shapeForegroundColor,M=this.shapeBackgroundColor;this.stylesheet=this.getDefaultStylesheet();this.shapeBackgroundColor="#ffffff";this.shapeForegroundColor="#000000";Y=d.createImageForPageLink(Y.originalSrc);this.shapeBackgroundColor=M;this.shapeForegroundColor=C;this.stylesheet=m}return Y};this.isOffline()||"undefined"===typeof window.EditDataDialog||(EditDataDialog.placeholderHelpLink="https://www.drawio.com/doc/faq/predefined-placeholders");