Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
new Action(mxResources.get("shadow"),function(){k.setShadowVisible(!k.shadowVisible)}));B.setToggleAction(!0);B.setSelectedCallback(function(){return k.shadowVisible});c.actions.put("about",new Action("v"+EditorUi.VERSION,function(l,y){}));c.actions.addAction("support...",function(){EditorUi.isElectronApp?c.openLink("https://github.com/jgraph/drawio-desktop/wiki/Getting-Support"):c.openLink("https://github.com/jgraph/drawio/wiki/Getting-Support")});c.actions.addAction("exportOptionsDisabled...",function(){c.handleError({message:mxResources.get("exportOptionsDisabledDetails")},
mxResources.get("exportOptionsDisabled"))});c.actions.addAction("keyboardShortcuts...",function(){!mxClient.IS_SVG||mxClient.IS_CHROMEAPP||EditorUi.isElectronApp?c.openLink("https://viewer.diagrams.net/#Uhttps%3A%2F%2Fviewer.diagrams.net%2Fshortcuts.svg"):c.openLink("shortcuts.svg")});c.actions.addAction("feedback...",function(){var l=new FeedbackDialog(c);c.showDialog(l.container,610,360,!0,!1);l.init()});c.actions.addAction("quickStart...",function(){"ac.draw.io"===window.location.hostname?c.openLink("https://www.youtube.com/watch?v=s5BG0705MHU"):