Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var GoogleSitesDialog=function(b,f){function m(){var S=null!=A&&null!=A.getTitle()?A.getTitle():this.defaultFilename;if(B.checked&&""!=J.value){var l="https://www.draw.io/gadget.xml?type=4&diagram="+encodeURIComponent(mxUtils.htmlEntities(J.value));null!=S&&(l+="&title="+encodeURIComponent(S));0<I.length&&(l+="&s="+I);""!=c.value&&"0"!=c.value&&(l+="&border="+c.value);""!=R.value&&(l+="&height="+R.value);l+="&pan="+(e.checked?"1":"0");l+="&zoom="+(g.checked?"1":"0");l+="&fit="+(x.checked?"1":"0");
l+="&resize="+(t.checked?"1":"0");l+="&x0="+Number(H.value);l+="&y0="+L;u.mathEnabled&&(l+="&math=1");p.checked?l+="&edit=_blank":q.checked&&(l+="&edit="+encodeURIComponent(mxUtils.htmlEntities(window.location.href)));N.value=l}else A.constructor==DriveFile||A.constructor==DropboxFile?(l="https://www.draw.io/gadget.xml?embed=0&diagram=",""!=J.value?l+=encodeURIComponent(mxUtils.htmlEntities(J.value))+"&type=3":(l+=A.getHash().substring(1),l=A.constructor==DropboxFile?l+"&type=2":l+"&type=1"),null!=
S&&(l+="&title="+encodeURIComponent(S)),""!=R.value&&(S=parseInt(R.value)+parseInt(H.value),l+="&height="+S),N.value=l):N.value=""}var d=document.createElement("div"),u=b.editor.graph,v=u.getGraphBounds(),E=u.view.scale,F=Math.floor(v.x/E-u.view.translate.x),L=Math.floor(v.y/E-u.view.translate.y);mxUtils.write(d,mxResources.get("googleGadget")+":");mxUtils.br(d);var N=document.createElement("input");N.setAttribute("type","text");N.style.marginBottom="8px";N.style.marginTop="2px";N.style.width="410px";