Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
c.actions.addAction("support...",function(){EditorUi.isElectronApp?c.openLink("https://github.com/jgraph/drawio-desktop/wiki/Getting-Support"):c.openLink("https://github.com/jgraph/drawio/wiki/Getting-Support")});c.actions.addAction("exportOptionsDisabled...",function(){c.handleError({message:mxResources.get("exportOptionsDisabledDetails")},mxResources.get("exportOptionsDisabled"))});c.actions.addAction("keyboardShortcuts...",function(){!mxClient.IS_SVG||mxClient.IS_CHROMEAPP||EditorUi.isElectronApp?