Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
P));var Q=document.createElement("link");Q.setAttribute("rel","preload");Q.setAttribute("href",P);Q.setAttribute("as","font");Q.setAttribute("crossorigin","");y.parentNode.insertBefore(Q,y)}}}};Editor.trimCssUrl=function(k){return k.replace(RegExp("^[\\s\"']+","g"),"").replace(RegExp("[\\s\"']+$","g"),"")};Editor.GOOGLE_FONTS="https://fonts.googleapis.com/css?family=";Editor.GUID_ALPHABET="0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_";Editor.GUID_LENGTH=20;Editor.guid=function(k){k=
null!=k?k:Editor.GUID_LENGTH;for(var y=[],G=0;G<k;G++)y.push(Editor.GUID_ALPHABET.charAt(Math.floor(Math.random()*Editor.GUID_ALPHABET.length)));return y.join("")};Editor.updateStatusInterval=1E4;Editor.prototype.appName="diagrams.net";Editor.prototype.diagramFileTypes=[{description:"diagramXmlDesc",extension:"drawio",mimeType:"text/xml"},{description:"diagramPngDesc",extension:"png",mimeType:"image/png"},{description:"diagramSvgDesc",extension:"svg",mimeType:"image/svg"},{description:"diagramHtmlDesc",