Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
K,0,K.length);U+=V(K.length)+B+K+V(R^4294967295);U+=m.substring(X-8,m.length);break}U+=m.substring(X-8,X-4+Y);W(m,Y);W(m,4)}while(Y);return"data:image/png;base64,"+(window.btoa?btoa(U):Base64.encode(U,!0))}};if(window.ColorDialog){FilenameDialog.filenameHelpLink="https://www.drawio.com/doc/faq/save-file-formats";var y=ColorDialog.addRecentColor;ColorDialog.addRecentColor=function(m,B){y.apply(this,arguments);mxSettings.setRecentColors(ColorDialog.recentColors);mxSettings.save()};var E=ColorDialog.resetRecentColors;