Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var CreateDialog=function(b,f,m,d,u,v,D,F,K,M,G,S,J,c,e,k,q){function p(n,z,E,A){function N(){mxEvent.addListener(Q,"click",function(){var H=E;if(D){var O=C.value,P=O.lastIndexOf(".");if(0>f.lastIndexOf(".")&&0>P){H=null!=H?H:l.value;var V="";H==App.MODE_GOOGLE?V=b.drive.extension:H==App.MODE_GITHUB?V=b.gitHub.extension:H==App.MODE_GITLAB?V=b.gitLab.extension:H==App.MODE_TRELLO?V=b.trello.extension:H==App.MODE_DROPBOX?V=b.dropbox.extension:H==App.MODE_ONEDRIVE?V=b.oneDrive.extension:H==App.MODE_DEVICE&&
(V=".drawio");0<=P&&(O=O.substring(0,P));C.value=O+V}}t(E)})}var Q=document.createElement("a");Q.style.overflow="hidden";var L=document.createElement("img");L.src=n;L.setAttribute("border","0");L.setAttribute("align","absmiddle");L.style.width="60px";L.style.height="60px";L.style.paddingBottom="6px";Q.style.display="inline-block";Q.className="geBaseButton";Q.style.position="relative";Q.style.margin="4px";Q.style.padding="8px 8px 10px 8px";Q.style.whiteSpace="nowrap";Q.appendChild(L);Q.style.color=
"gray";Q.style.fontSize="11px";var U=document.createElement("div");Q.appendChild(U);mxUtils.write(U,z);if(null!=A&&null==b[A]){L.style.visibility="hidden";mxUtils.setOpacity(U,10);var g=new Spinner({lines:12,length:12,width:5,radius:10,rotate:0,color:"#000",speed:1.5,trail:60,shadow:!1,hwaccel:!1,top:"40%",zIndex:2E9});g.spin(Q);var y=window.setTimeout(function(){null==b[A]&&(g.stop(),Q.style.display="none")},3E4);b.addListener("clientLoaded",mxUtils.bind(this,function(){null!=b[A]&&(window.clearTimeout(y),
mxUtils.setOpacity(U,100),L.style.visibility="",g.stop(),N())}))}else N();B.appendChild(Q);++T==S&&(mxUtils.br(B),T=0)}function t(n){var z=C.value;if(null==n||null!=z&&0<z.length)q&&b.hideDialog(),m(z,n,C)}G="1"==urlParams.noDevice?!1:G;D=null!=D?D:!0;F=null!=F?F:!0;S=null!=S?S:4;q=null!=q?q:!0;v=document.createElement("div");v.style.whiteSpace="nowrap";null==d&&b.addLanguageMenu(v);var x=document.createElement("h2");mxUtils.write(x,u||mxResources.get("create"));x.style.marginTop="0px";x.style.marginBottom=