Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(this.buttonContainer.appendChild(c),this.editor.fireEvent(new mxEventObject("statusChanged")))};EditorUi.prototype.showImportCsvDialog=function(){null==this.importCsvDialog&&(this.importCsvDialog=new TextareaDialog(this,mxResources.get("csv")+":",Editor.defaultCsvValue,mxUtils.bind(this,function(c){this.importCsv(c)}),null,null,620,430,null,!0,!0,mxResources.get("import"),this.isOffline()?null:"https://drawio-app.com/import-from-csv-to-drawio/"));this.showDialog(this.importCsvDialog.container,640,
520,!0,!0,null,null,null,null,!0);this.importCsvDialog.init()};EditorUi.prototype.showCustomLayoutDialog=function(c){this.loadOrgChartLayouts(mxUtils.bind(this,function(){var e=new TextareaDialog(this,mxResources.get("layout"),c,mxUtils.bind(this,function(g){if(0<g.length)try{var q=JSON.parse(g);this.executeLayouts(this.editor.graph.createLayouts(q));this.customLayoutConfig=q;this.hideDialog()}catch(p){this.handleError(p)}}),null,null,null,null,mxUtils.bind(this,function(g,q){var p=mxUtils.button(mxResources.get("copy"),