Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
FilenameDialog.createFileTypes=function(b,e,g){var p=document.createElement("select");for(b=0;b<g.length;b++){var y=document.createElement("option");y.setAttribute("value",b);mxUtils.write(y,mxResources.get(g[b].description)+" (."+g[b].extension+")");p.appendChild(y)}mxEvent.addListener(p,"change",function(q){q=g[p.value].extension;var E=e.value.lastIndexOf(".drawio.");E=0<E?E:e.value.lastIndexOf(".");"drawio"!=q&&(q="drawio."+q);e.value=0<E?e.value.substring(0,E+1)+q:e.value+"."+q;"createEvent"in
document?(q=document.createEvent("HTMLEvents"),q.initEvent("change",!1,!0),e.dispatchEvent(q)):e.fireEvent("onchange")});b=function(q){q=e.value.toLowerCase();for(var E=0,M=0;M<g.length;M++){var T=g[M].extension,F=null;"drawio"!=T&&(F=T,T=".drawio."+T);if(q.substring(q.length-T.length-1)=="."+T||null!=F&&q.substring(q.length-F.length-1)=="."+F){E=M;break}}p.value=E};mxEvent.addListener(e,"change",b);mxEvent.addListener(e,"keyup",b);b();return p};