Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
520,!0,!0,null,null,null,null,!0);this.importCsvDialog.init()};EditorUi.prototype.showCustomLayoutDialog=function(c){this.loadOrgChartLayouts(mxUtils.bind(this,function(){var e=new TextareaDialog(this,mxResources.get("layout"),c,mxUtils.bind(this,function(g){if(0<g.length)try{var q=JSON.parse(g);this.executeLayouts(this.editor.graph.createLayouts(q));this.customLayoutConfig=q;this.hideDialog()}catch(p){this.handleError(p)}}),null,null,null,null,mxUtils.bind(this,function(g,q){var p=mxUtils.button(mxResources.get("copy"),
mxUtils.bind(this,function(){try{var t=q.value;q.value=JSON.stringify(JSON.parse(t));q.focus();mxClient.IS_GC||mxClient.IS_FF||5<=document.documentMode?q.select():document.execCommand("selectAll",!1,null);document.execCommand("copy");this.alert(mxResources.get("copiedToClipboard"));q.value=t}catch(x){this.handleError(x)}}));p.setAttribute("title","copy");p.className="geBtn";g.appendChild(p)}),!0,null,null,"https://www.drawio.com/doc/faq/apply-layouts");this.showDialog(e.container,620,460,!0,!0);e.init()}))};