Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var CreateDialog=function(b,e,f,c,k,l,x,y,E,D,z,M,I,d,g,n,t){function u(q,C,J,G){function P(){mxEvent.addListener(O,"click",function(){var K=J;if(x){var R=H.value,U=R.lastIndexOf(".");if(0>e.lastIndexOf(".")&&0>U){K=null!=K?K:p.value;var W="";K==App.MODE_GOOGLE?W=b.drive.extension:K==App.MODE_GITHUB?W=b.gitHub.extension:K==App.MODE_GITLAB?W=b.gitLab.extension:K==App.MODE_TRELLO?W=b.trello.extension:K==App.MODE_DROPBOX?W=b.dropbox.extension:K==App.MODE_ONEDRIVE?W=b.oneDrive.extension:K==App.MODE_DEVICE&&
(W=".drawio");0<=U&&(R=R.substring(0,U));H.value=R+W}}v(J)})}var O=document.createElement("a");O.style.overflow="hidden";var N=document.createElement("img");N.src=q;N.setAttribute("border","0");N.setAttribute("align","absmiddle");N.style.width="60px";N.style.height="60px";N.style.paddingBottom="6px";O.style.display="inline-block";O.className="geBaseButton";O.style.position="relative";O.style.margin="4px";O.style.padding="8px 8px 10px 8px";O.style.whiteSpace="nowrap";O.appendChild(N);O.style.color=