Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"https://github.com/apps/diagrams-net-app-test":"https://github.com/apps/draw-io-app")}),mxResources.get("cancel"),f,480,null,!1)};GitHubClient.prototype.executeRequest=function(e,f,c,k,l){var x=mxUtils.bind(this,function(E){var D=!0,z=window.setTimeout(mxUtils.bind(this,function(){D=!1;c({code:App.ERROR_TIMEOUT,retry:y})}),this.ui.timeout),M=this.authToken+" "+b;e.setRequestHeaders=function(I,d){I.setRequestHeader("Authorization",M)};e.send(mxUtils.bind(this,function(){window.clearTimeout(z);var I=