Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
document?(q=document.createEvent("HTMLEvents"),q.initEvent("change",!1,!0),e.dispatchEvent(q)):e.fireEvent("onchange")});b=function(q){q=e.value.toLowerCase();for(var E=0,N=0;N<g.length;N++){var T=g[N].extension,F=null;"drawio"!=T&&(F=T,T=".drawio."+T);if(q.substring(q.length-T.length-1)=="."+T||null!=F&&q.substring(q.length-F.length-1)=="."+F){E=N;break}}n.value=E};mxEvent.addListener(e,"change",b);mxEvent.addListener(e,"keyup",b);b();return n};