Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var GoogleSitesDialog=function(b,e){function f(){var S=null!=F&&null!=F.getTitle()?F.getTitle():this.defaultFilename;if(H.checked&&""!=I.value){var p="https://www.draw.io/gadget.xml?type=4&diagram="+encodeURIComponent(mxUtils.htmlEntities(I.value));null!=S&&(p+="&title="+encodeURIComponent(S));0<L.length&&(p+="&s="+L);""!=d.value&&"0"!=d.value&&(p+="&border="+d.value);""!=M.value&&(p+="&height="+M.value);p+="&pan="+(g.checked?"1":"0");p+="&zoom="+(n.checked?"1":"0");p+="&fit="+(A.checked?"1":"0");
p+="&resize="+(v.checked?"1":"0");p+="&x0="+Number(z.value);p+="&y0="+E;k.mathEnabled&&(p+="&math=1");u.checked?p+="&edit=_blank":t.checked&&(p+="&edit="+encodeURIComponent(mxUtils.htmlEntities(window.location.href)));D.value=p}else F.constructor==DriveFile||F.constructor==DropboxFile?(p="https://www.draw.io/gadget.xml?embed=0&diagram=",""!=I.value?p+=encodeURIComponent(mxUtils.htmlEntities(I.value))+"&type=3":(p+=F.getHash().substring(1),p=F.constructor==DropboxFile?p+"&type=2":p+"&type=1"),null!=
S&&(p+="&title="+encodeURIComponent(S)),""!=M.value&&(S=parseInt(M.value)+parseInt(z.value),p+="&height="+S),D.value=p):D.value=""}var c=document.createElement("div"),k=b.editor.graph,l=k.getGraphBounds(),x=k.view.scale,y=Math.floor(l.x/x-k.view.translate.x),E=Math.floor(l.y/x-k.view.translate.y);mxUtils.write(c,mxResources.get("googleGadget")+":");mxUtils.br(c);var D=document.createElement("input");D.setAttribute("type","text");D.style.marginBottom="8px";D.style.marginTop="2px";D.style.width="410px";