Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var CreateDialog=function(b,f,m,d,u,v,E,F,L,N,H,R,J,c,e,g,q){function p(n,z,C,D){function M(){mxEvent.addListener(K,"click",function(){var G=C;if(E){var P=B.value,Q=P.lastIndexOf(".");if(0>f.lastIndexOf(".")&&0>Q){G=null!=G?G:l.value;var U="";G==App.MODE_GOOGLE?U=b.drive.extension:G==App.MODE_GITHUB?U=b.gitHub.extension:G==App.MODE_GITLAB?U=b.gitLab.extension:G==App.MODE_TRELLO?U=b.trello.extension:G==App.MODE_DROPBOX?U=b.dropbox.extension:G==App.MODE_ONEDRIVE?U=b.oneDrive.extension:G==App.MODE_DEVICE&&
(U=".drawio");0<=Q&&(P=P.substring(0,Q));B.value=P+U}}t(C)})}var K=document.createElement("a");K.style.overflow="hidden";var O=document.createElement("img");O.src=n;O.setAttribute("border","0");O.setAttribute("align","absmiddle");O.style.width="60px";O.style.height="60px";O.style.paddingBottom="6px";K.style.display="inline-block";K.className="geBaseButton";K.style.position="relative";K.style.margin="4px";K.style.padding="8px 8px 10px 8px";K.style.whiteSpace="nowrap";K.appendChild(O);K.style.color=
"gray";K.style.fontSize="11px";var V=document.createElement("div");K.appendChild(V);mxUtils.write(V,z);if(null!=D&&null==b[D]){O.style.visibility="hidden";mxUtils.setOpacity(V,10);var k=new Spinner({lines:12,length:12,width:5,radius:10,rotate:0,color:"#000",speed:1.5,trail:60,shadow:!1,hwaccel:!1,top:"40%",zIndex:2E9});k.spin(K);var y=window.setTimeout(function(){null==b[D]&&(k.stop(),K.style.display="none")},3E4);b.addListener("clientLoaded",mxUtils.bind(this,function(){null!=b[D]&&(window.clearTimeout(y),
mxUtils.setOpacity(V,100),O.style.visibility="",k.stop(),M())}))}else M();A.appendChild(K);++S==R&&(mxUtils.br(A),S=0)}function t(n){var z=B.value;if(null==n||null!=z&&0<z.length)q&&b.hideDialog(),m(z,n,B)}H="1"==urlParams.noDevice?!1:H;E=null!=E?E:!0;F=null!=F?F:!0;R=null!=R?R:4;q=null!=q?q:!0;v=document.createElement("div");v.style.whiteSpace="nowrap";null==d&&b.addLanguageMenu(v);var x=document.createElement("h2");mxUtils.write(x,u||mxResources.get("create"));x.style.marginTop="0px";x.style.marginBottom=