Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"")+"/log?severity="+v+"&v="+encodeURIComponent(EditorUi.VERSION)+"&msg=clientError:"+encodeURIComponent(d)+":url:"+encodeURIComponent(window.location.href)+":lnum:"+encodeURIComponent(n)+(null!=t?":colno:"+encodeURIComponent(t):"")+(""!=u.stack?"&stack="+encodeURIComponent(u.stack):""))}catch(H){}try{A||null==window.console||console.error(v,d,g,n,t,u)}catch(H){}}};EditorUi.logEvent=function(d){if("1"==urlParams.dev)EditorUi.debug("logEvent",d);else if(EditorUi.enableLogging)try{var g=null!=window.DRAWIO_LOG_URL?
window.DRAWIO_LOG_URL:"";(new Image).src=g+"/images/1x1.png?v="+encodeURIComponent(EditorUi.VERSION)+(null!=d?"&data="+encodeURIComponent(JSON.stringify(d)):"")}catch(n){}};EditorUi.sendReport=function(d,g){if("1"==urlParams.dev)EditorUi.debug("sendReport",d);else if(EditorUi.enableLogging)try{g=null!=g?g:5E4,d.length>g&&(d=d.substring(0,g)+"\n...[SHORTENED]"),mxUtils.post("/email","version="+encodeURIComponent(EditorUi.VERSION)+"&url="+encodeURIComponent(window.location.href)+"&data="+encodeURIComponent(d))}catch(n){}};