Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
g=document.createElement("div");g.style.whiteSpace="nowrap";g.style.height="30px";z.appendChild(g);n=mxUtils.button(mxResources.get("Templates",null,"Templates"),function(){wa.style.display="";qa.style.display="";da.style.left="160px";X(0);da.scrollTop=0;da.innerText="";K=0;U!=Ha&&(Ha=U,ua=T,Da=W,wa.innerText="",l(),U=null)});Q.push(n);g.appendChild(n);var Y=function(aa){wa.style.display="none";qa.style.display="none";da.style.left="30px";X(aa?-1:1);null==U&&(U=Ha);da.scrollTop=0;da.innerText="";
O.spin(da);var la=function(ma,oa,fa){K=0;O.stop();Ha=ma;fa=fa||{};var ja=0,sa;for(sa in fa)ja+=fa[sa].length;if(oa)da.innerText=oa;else if(0==ma.length&&0==ja)da.innerText=mxResources.get("noDiagrams",null,"No Diagrams Found");else if(da.innerText="",0<ja){wa.style.display="";da.style.left="160px";wa.innerText="";Da=0;ua={"draw.io":ma};for(sa in fa)ua[sa]=fa[sa];l()}else t(!0)};aa?J(Z.value,la):R(la)};R&&(n=mxUtils.button(mxResources.get("Recent",null,"Recent"),function(){Y()}),g.appendChild(n),Q.push(n));