Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!1,!1),d.pdfPageExport||mxEvent.addListener(P,"change",C);C=!mxClient.IS_CHROMEAPP&&!EditorUi.isElectronApp&&"draw.io"==d.getServiceName();var T=null,W=null;if(EditorUi.isElectronApp||C)W=d.addCheckbox(n,mxResources.get("includeCopyOfMyDiagram"),Editor.defaultIncludeDiagram),z+=30;C&&(T=d.addCheckbox(n,mxResources.get("transparentBackground"),!1),z+=30);n=new CustomDialog(d,n,mxUtils.bind(this,function(){var X=null;if(!l){X=parseInt(k.value);var Y=parseInt(G.value);X=O.checked||X==M&&Y==M?null:{from:Math.max(0,
Math.min(D-1,X-1)),to:Math.max(0,Math.min(D-1,Y-1))}}d.downloadFile("pdf",null,null,!P.checked,l?!0:!O.checked&&null==X,!Q.checked,null!=T&&T.checked,null,null,U.checked,null!=W&&W.checked,X)}),null,mxResources.get("export"));d.showDialog(n.container,300,z,!0,!0)}else d.showDialog((new PrintDialog(d,mxResources.get("formatPdf"))).container,360,null!=d.pages&&1<d.pages.length&&(d.editor.editable||"1"!=urlParams["hide-pages"])?470:390,!0,!0)}));d.actions.addAction("open...",function(){d.pickFile()});