Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!c.isOfflineApp()&&isLocalStorage&&this.addMenuItem(p,"plugins",q),this.addMenuItems(p,["-","editDiagram"],q),this.addSubmenu("diagramLanguage",p,q),p.addSeparator(q),"1"!=urlParams.embed&&(isLocalStorage||mxClient.IS_CHROMEAPP)&&this.addMenuItems(p,["showStartScreen"],q),this.addMenuItems(p,["configuration"],q),p.addSeparator(q),"1"==urlParams.newTempDlg&&(c.actions.addAction("templates",function(){function J(P){return{id:P.id,isExt:!0,url:P.downloadUrl,title:P.title,imgUrl:P.thumbnailLink,changedBy:P.lastModifyingUserName,
lastModifiedOn:P.modifiedDate}}var G=new TemplatesDialog(c,function(P){console.log(arguments)},null,null,null,"user",function(P,O,N){var T=new Date;T.setDate(T.getDate()-7);c.drive.listFiles(null,T,N?!0:!1,function(m){for(var B=[],K=0;K<m.items.length;K++)B.push(J(m.items[K]));P(B)},O)},function(P,O,N,T){c.drive.listFiles(P,null,T?!0:!1,function(m){for(var B=[],K=0;K<m.items.length;K++)B.push(J(m.items[K]));O(B)},N)},function(P,O,N){c.drive.getFile(P.id,function(T){O(T.data)},N)},null,function(P){P({Test:[]},