Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(c,e,g,q,p,t,x){if(null!=c){p=null!=p?p:Error(c);p.stack=null!=p.stack?p.stack:"";t=null!=t?t:0>c.indexOf("NetworkError")&&0>c.indexOf("SecurityError")&&0>c.indexOf("NS_ERROR_FAILURE")&&0>c.indexOf("out of memory")?"SEVERE":"CONFIG";try{EditorUi.enableLogging&&"1"!=urlParams.dev&&c!=EditorUi.lastErrorMessage&&0>c.indexOf("extension:")&&0>p.stack.indexOf("extension:")&&0>p.stack.indexOf("<anonymous>:")&&(EditorUi.lastErrorMessage=c,(new Image).src=(null!=window.DRAWIO_LOG_URL?window.DRAWIO_LOG_URL:
"")+"/log?severity="+t+"&v="+encodeURIComponent(EditorUi.VERSION)+"&msg=clientError:"+encodeURIComponent(c)+":url:"+encodeURIComponent(window.location.href)+":lnum:"+encodeURIComponent(g)+(null!=q?":colno:"+encodeURIComponent(q):"")+(""!=p.stack?"&stack="+encodeURIComponent(p.stack):""))}catch(B){}try{x||null==window.console||console.error(t,c,e,g,q,p)}catch(B){}}};EditorUi.logEvent=function(c){if("1"==urlParams.dev)EditorUi.debug("logEvent",c);else if(EditorUi.enableLogging)try{var e=null!=window.DRAWIO_LOG_URL?