Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
GraphViewer.logAncestorFrames=function(){try{if(window.location.ancestorOrigins&&window.location.hostname&&window.location.ancestorOrigins.length&&0<window.location.ancestorOrigins.length){var b=window.location.hostname;b&&1<b.length&&"/"==b.charAt(b.length-1)&&(b=b.substring(0,b.length-1));for(var e="",g=0;g<window.location.ancestorOrigins.length;g++)e+=" -> "+window.location.ancestorOrigins[g];!(b.endsWith(".draw.io")&&1==window.location.ancestorOrigins.length&&window.location.ancestorOrigins[0]&&
window.location.ancestorOrigins[0].endsWith(".atlassian.net"))&&0<window.location.ancestorOrigins.length&&((new Image).src="https://log.diagrams.net/images/1x1.png?src=ViewerAncestorFrames"+("undefined"!==typeof window.EditorUi?"&v="+encodeURIComponent(EditorUi.VERSION):"")+"&data="+encodeURIComponent(e))}}catch(p){}};