Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"/"+(0<O.length?"?"+O.join("&"):"")+l};EditorUi.prototype.createHtml=function(d,f,l,u,A,B,F,M,O,H,ja,da){this.getBasenames();var ca={};""!=A&&A!=mxConstants.NONE&&(ca.highlight=A);"auto"!==u&&(ca.target=u);H||(ca.lightbox=!1);ca.nav=this.editor.graph.foldingEnabled;l=parseInt(l);isNaN(l)||100==l||(ca.zoom=l/100);l=[];F&&(l.push("pages"),ca.resize=!0,null!=this.pages&&null!=this.currentPage&&(ca.page=mxUtils.indexOf(this.pages,this.currentPage)));f&&(l.push("zoom"),ca.resize=!0);M&&l.push("layers");
O&&l.push("tags");0<l.length&&(H&&l.push("lightbox"),ca.toolbar=l.join(" "));null!=ja&&0<ja.length&&(ca.edit=ja);null!=d?ca.url=d:ca.xml=this.getFileData(!0,null,null,null,null,!F);f='<div class="mxgraph" style="'+(B?"max-width:100%;":"")+(""!=l?"border:1px solid transparent;":"")+'" data-mxgraph="'+mxUtils.htmlEntities(JSON.stringify(ca))+'"></div>';d=null!=d?"&fetch="+encodeURIComponent(d):"";da(f,'<script type="text/javascript" src="'+(0<d.length?("1"==urlParams.dev?"https://test.draw.io/embed2.js?dev=1":
EditorUi.lightboxHost+"/embed2.js?")+d:"1"==urlParams.dev?"https://test.draw.io/js/viewer-static.min.js":window.DRAWIO_VIEWER_URL?window.DRAWIO_VIEWER_URL:EditorUi.lightboxHost+"/js/viewer-static.min.js")+'">\x3c/script>')};EditorUi.prototype.showHtmlDialog=function(d,f,l,u){var A=document.createElement("div");A.style.whiteSpace="nowrap";var B=document.createElement("h3");mxUtils.write(B,mxResources.get("html"));B.style.cssText="width:100%;text-align:center;margin-top:0px;margin-bottom:12px";A.appendChild(B);