Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
n=document.createElement("div");n.style.whiteSpace="nowrap";n.style.height="30px";C.appendChild(n);q=mxUtils.button(mxResources.get("Templates",null,"Templates"),function(){ta.style.display="";qa.style.display="";fa.style.left="160px";X(0);fa.scrollTop=0;fa.innerText="";O=0;W!=Ga&&(Ga=W,sa=Q,Da=V,ta.innerText="",p(),W=null)});U.push(q);n.appendChild(q);var Y=function(aa){ta.style.display="none";qa.style.display="none";fa.style.left="30px";X(aa?-1:1);null==W&&(W=Ga);fa.scrollTop=0;fa.innerText="";
N.spin(fa);var la=function(na,pa,ha){O=0;N.stop();Ga=na;ha=ha||{};var ka=0,ua;for(ua in ha)ka+=ha[ua].length;if(pa)fa.innerText=pa;else if(0==na.length&&0==ka)fa.innerText=mxResources.get("noDiagrams",null,"No Diagrams Found");else if(fa.innerText="",0<ka){ta.style.display="";fa.style.left="160px";ta.innerText="";Da=0;sa={"draw.io":na};for(ua in ha)sa[ua]=ha[ua];p()}else v(!0)};aa?I(Z.value,la):M(la)};M&&(q=mxUtils.button(mxResources.get("Recent",null,"Recent"),function(){Y()}),n.appendChild(q),U.push(q));