Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(c.innerHTML="Error loading page. <a>Please try refreshing.</a>",c.getElementsByTagName("a")[0].onclick=function(){mxLanguage="en";d(mxResources.getDefaultBundle(RESOURCE_BASE,mxLanguage)||mxResources.getSpecialBundle(RESOURCE_BASE,mxLanguage))})})};if(!App.isMainCalled)if(App.isMainCalled=!0,window.onerror=function(J,c,e,g,q){EditorUi.logError("Global: "+(null!=J?J:""),c,e,g,q,null,!0);null==window.console||EditorUi.isElectronApp?(mxLog.show(),mxLog.debug("Message:",J,"\nURL:",c,"\nLine:",e,"\nColumn:",
g,"\nError:",q)):console.error("Message:",J,"\nURL:",c,"\nLine:",e,"\nColumn:",g,"\nError:",q);window.setTimeout(function(){alert("Error: "+(null!=J?J:""))},100)},window.top!=window.self||"import.diagrams.net"!==window.location.hostname&&"ac.draw.io"!==window.location.hostname&&"aj.draw.io"!==window.location.hostname){if("1"==urlParams.embed||"1"==urlParams.lightbox){var u=document.getElementById("geInfo");null!=u&&u.parentNode.removeChild(u)}null!=document.referrer&&"aws3"==urlParams.libs&&"https://aws.amazon.com/architecture/icons/"==