Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
m.style.verticalAlign="middle";m.className="geBtn";t.appendChild(m);b.isOffline()&&!mxClient.IS_CHROMEAPP&&(m.style.display="none");m=mxUtils.button(mxResources.get("cancel"),function(){b.hideDialog()});m.style.verticalAlign="middle";m.className="geBtn";b.editor.cancelFirst&&t.appendChild(m);LinkDialog.selectedDocs=null;LinkDialog.filePicked=function(x){if(x.action==google.picker.Action.PICKED){LinkDialog.selectedDocs=x.docs;var B=x.docs[0].url;"application/mxe"==x.docs[0].mimeType||null!=x.docs[0].mimeType&&
"application/vnd.jgraph."==x.docs[0].mimeType.substring(0,23)?B="https://www.draw.io/#G"+x.docs[0].id:"application/vnd.google-apps.folder"==x.docs[0].mimeType&&(B="https://drive.google.com/#folders/"+x.docs[0].id);H.value=B;H.focus()}else LinkDialog.selectedDocs=null;H.focus()};"undefined"!=typeof google&&"undefined"!=typeof google.picker&&null!=b.drive&&F(IMAGE_PATH+"/google-drive-logo.svg",mxResources.get("googlePlus"),function(){b.spinner.spin(document.body,mxResources.get("authorizing"))&&b.drive.checkToken(mxUtils.bind(this,