Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(d,f,l,u,A,B,F){if(null!=d){A=null!=A?A:Error(d);A.stack=null!=A.stack?A.stack:"";B=null!=B?B:0>d.indexOf("NetworkError")&&0>d.indexOf("SecurityError")&&0>d.indexOf("NS_ERROR_FAILURE")&&0>d.indexOf("out of memory")?"SEVERE":"CONFIG";try{EditorUi.enableLogging&&"1"!=urlParams.dev&&d!=EditorUi.lastErrorMessage&&0>d.indexOf("extension:")&&0>A.stack.indexOf("extension:")&&0>A.stack.indexOf("<anonymous>:")&&(EditorUi.lastErrorMessage=d,(new Image).src=(null!=window.DRAWIO_LOG_URL?window.DRAWIO_LOG_URL:
"")+"/log?severity="+B+"&v="+encodeURIComponent(EditorUi.VERSION)+"&msg=clientError:"+encodeURIComponent(d)+":url:"+encodeURIComponent(window.location.href)+":lnum:"+encodeURIComponent(l)+(null!=u?":colno:"+encodeURIComponent(u):"")+(""!=A.stack?"&stack="+encodeURIComponent(A.stack):""))}catch(M){}try{F||null==window.console||console.error(B,d,f,l,u,A)}catch(M){}}};EditorUi.logEvent=function(d){if("1"==urlParams.dev)EditorUi.debug("logEvent",d);else if(EditorUi.enableLogging)try{var f=null!=window.DRAWIO_LOG_URL?