Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
k=document.createElement("div");k.style.whiteSpace="nowrap";k.style.height="30px";z.appendChild(k);n=mxUtils.button(mxResources.get("Templates",null,"Templates"),function(){wa.style.display="";qa.style.display="";ca.style.left="160px";X(0);ca.scrollTop=0;ca.innerText="";Q=0;V!=Ha&&(Ha=V,ua=R,Da=W,wa.innerText="",l(),V=null)});P.push(n);k.appendChild(n);var Z=function(aa){wa.style.display="none";qa.style.display="none";ca.style.left="30px";X(aa?-1:1);null==V&&(V=Ha);ca.scrollTop=0;ca.innerText="";
L.spin(ca);var la=function(ma,oa,ha){Q=0;L.stop();Ha=ma;ha=ha||{};var ja=0,sa;for(sa in ha)ja+=ha[sa].length;if(oa)ca.innerText=oa;else if(0==ma.length&&0==ja)ca.innerText=mxResources.get("noDiagrams",null,"No Diagrams Found");else if(ca.innerText="",0<ja){wa.style.display="";ca.style.left="160px";wa.innerText="";Da=0;ua={"draw.io":ma};for(sa in ha)ua[sa]=ha[sa];l()}else t(!0)};aa?J(Y.value,la):S(la)};S&&(n=mxUtils.button(mxResources.get("Recent",null,"Recent"),function(){Z()}),k.appendChild(n),P.push(n));