Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
520,!0,!0,null,null,null,null,!0);this.importCsvDialog.init()};EditorUi.prototype.showCustomLayoutDialog=function(d){this.loadOrgChartLayouts(mxUtils.bind(this,function(){var g=new TextareaDialog(this,mxResources.get("layout"),d,mxUtils.bind(this,function(n){if(0<n.length)try{var t=JSON.parse(n);this.executeLayouts(this.editor.graph.createLayouts(t));this.customLayoutConfig=t;this.hideDialog()}catch(u){this.handleError(u)}}),null,null,null,null,mxUtils.bind(this,function(n,t){var u=mxUtils.button(mxResources.get("copy"),
mxUtils.bind(this,function(){try{var v=t.value;t.value=JSON.stringify(JSON.parse(v));t.focus();mxClient.IS_GC||mxClient.IS_FF||5<=document.documentMode?t.select():document.execCommand("selectAll",!1,null);document.execCommand("copy");this.alert(mxResources.get("copiedToClipboard"));t.value=v}catch(A){this.handleError(A)}}));u.setAttribute("title","copy");u.className="geBtn";n.appendChild(u)}),!0,null,null,"https://www.drawio.com/doc/faq/apply-layouts");this.showDialog(g.container,620,460,!0,!0);g.init()}))};