Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var CreateDialog=function(b,f,m,d,u,v,E,F,L,N,H,R,J,c,e,g,q){function p(n,z,C,D){function M(){mxEvent.addListener(K,"click",function(){var G=C;if(E){var P=B.value,Q=P.lastIndexOf(".");if(0>f.lastIndexOf(".")&&0>Q){G=null!=G?G:l.value;var U="";G==App.MODE_GOOGLE?U=b.drive.extension:G==App.MODE_GITHUB?U=b.gitHub.extension:G==App.MODE_GITLAB?U=b.gitLab.extension:G==App.MODE_TRELLO?U=b.trello.extension:G==App.MODE_DROPBOX?U=b.dropbox.extension:G==App.MODE_ONEDRIVE?U=b.oneDrive.extension:G==App.MODE_DEVICE&&
(U=".drawio");0<=Q&&(P=P.substring(0,Q));B.value=P+U}}t(C)})}var K=document.createElement("a");K.style.overflow="hidden";var O=document.createElement("img");O.src=n;O.setAttribute("border","0");O.setAttribute("align","absmiddle");O.style.width="60px";O.style.height="60px";O.style.paddingBottom="6px";K.style.display="inline-block";K.className="geBaseButton";K.style.position="relative";K.style.margin="4px";K.style.padding="8px 8px 10px 8px";K.style.whiteSpace="nowrap";K.appendChild(O);K.style.color=