Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
d,f,l,u,A,M,H);da!=this.editor.graph&&da.container.parentNode.removeChild(da.container);return d};EditorUi.prototype.getHtml=function(d,f,l,u,A,B){B=null!=B?B:!0;var F=null,M=EditorUi.drawHost+"/js/embed-static.min.js";if(null!=f){F=B?f.getGraphBounds():f.getBoundingBox(f.getSelectionCells());var O=f.view.scale;B=Math.floor(F.x/O-f.view.translate.x);O=Math.floor(F.y/O-f.view.translate.y);F=f.background;null==A&&(f=this.getBasenames().join(";"),0<f.length&&(M=EditorUi.drawHost+"/embed.js?s="+f));d.setAttribute("x0",
B);d.setAttribute("y0",O)}null!=d&&(d.setAttribute("pan","1"),d.setAttribute("zoom","1"),d.setAttribute("resize","0"),d.setAttribute("fit","0"),d.setAttribute("border","20"),d.setAttribute("links","1"),null!=u&&d.setAttribute("edit",u));null!=A&&(A=A.replace(/&/g,"&amp;"));d=null!=d?Graph.zapGremlins(mxUtils.getXml(d)):"";u=Graph.compress(d);Graph.decompress(u)!=d&&(u=encodeURIComponent(d));return(null==A?'\x3c!--[if IE]><meta http-equiv="X-UA-Compatible" content="IE=5,IE=9" ><![endif]--\x3e\n':"")+
"<!DOCTYPE html>\n<html"+(null!=A?' xmlns="http://www.w3.org/1999/xhtml">':">")+"\n<head>\n"+(null==A?null!=l?"<title>"+mxUtils.htmlEntities(l)+"</title>\n":"":"<title>draw.io</title>\n")+(null!=A?'<meta http-equiv="refresh" content="0;URL=\''+A+"'\"/>\n":"")+"</head>\n<body"+(null==A&&null!=F&&F!=mxConstants.NONE?' style="background-color:'+F+';">':">")+'\n<div class="mxgraph" style="position:relative;overflow:auto;width:100%;">\n<div style="width:1px;height:1px;overflow:hidden;">'+u+"</div>\n</div>\n"+
(null==A?'<script type="text/javascript" src="'+M+'">\x3c/script>':'<a style="position:absolute;top:50%;left:50%;margin-top:-128px;margin-left:-64px;" href="'+A+'" target="_blank"><img border="0" src="'+EditorUi.drawHost+'/images/drawlogo128.png"/></a>')+"\n</body>\n</html>\n"};EditorUi.prototype.getHtml2=function(d,f,l,u,A){f=window.DRAWIO_VIEWER_URL||EditorUi.drawHost+"/js/viewer-static.min.js";null!=A&&(A=A.replace(/&/g,"&amp;"));d={highlight:"#0000ff",nav:this.editor.graph.foldingEnabled,resize:!0,