Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var CreateDialog=function(b,e,f,c,k,l,x,y,E,D,z,M,I,d,g,n,t){function u(q,C,J,G){function P(){mxEvent.addListener(O,"click",function(){var K=J;if(x){var R=H.value,U=R.lastIndexOf(".");if(0>e.lastIndexOf(".")&&0>U){K=null!=K?K:p.value;var W="";K==App.MODE_GOOGLE?W=b.drive.extension:K==App.MODE_GITHUB?W=b.gitHub.extension:K==App.MODE_GITLAB?W=b.gitLab.extension:K==App.MODE_TRELLO?W=b.trello.extension:K==App.MODE_DROPBOX?W=b.dropbox.extension:K==App.MODE_ONEDRIVE?W=b.oneDrive.extension:K==App.MODE_DEVICE&&
(W=".drawio");0<=U&&(R=R.substring(0,U));H.value=R+W}}v(J)})}var O=document.createElement("a");O.style.overflow="hidden";var N=document.createElement("img");N.src=q;N.setAttribute("border","0");N.setAttribute("align","absmiddle");N.style.width="60px";N.style.height="60px";N.style.paddingBottom="6px";O.style.display="inline-block";O.className="geBaseButton";O.style.position="relative";O.style.margin="4px";O.style.padding="8px 8px 10px 8px";O.style.whiteSpace="nowrap";O.appendChild(N);O.style.color=
"gray";O.style.fontSize="11px";var T=document.createElement("div");O.appendChild(T);mxUtils.write(T,C);if(null!=G&&null==b[G]){N.style.visibility="hidden";mxUtils.setOpacity(T,10);var m=new Spinner({lines:12,length:12,width:5,radius:10,rotate:0,color:"#000",speed:1.5,trail:60,shadow:!1,hwaccel:!1,top:"40%",zIndex:2E9});m.spin(O);var B=window.setTimeout(function(){null==b[G]&&(m.stop(),O.style.display="none")},3E4);b.addListener("clientLoaded",mxUtils.bind(this,function(){null!=b[G]&&(window.clearTimeout(B),
mxUtils.setOpacity(T,100),N.style.visibility="",m.stop(),P())}))}else P();F.appendChild(O);++S==M&&(mxUtils.br(F),S=0)}function v(q){var C=H.value;if(null==q||null!=C&&0<C.length)t&&b.hideDialog(),f(C,q,H)}z="1"==urlParams.noDevice?!1:z;x=null!=x?x:!0;y=null!=y?y:!0;M=null!=M?M:4;t=null!=t?t:!0;l=document.createElement("div");l.style.whiteSpace="nowrap";null==c&&b.addLanguageMenu(l);var A=document.createElement("h2");mxUtils.write(A,k||mxResources.get("create"));A.style.marginTop="0px";A.style.marginBottom=