Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxscript("https://apis.google.com/js/api.js?onload=DrawGapiClientCallback",null,null,null,mxClient.IS_SVG):"undefined"===typeof window.gapi&&(window.DriveClient=null)}"0"!=urlParams.math&&Editor.initMath();if("1"==urlParams.configure){var N=window.opener||window.parent,H=function(J){if(J.source==N)try{var c=JSON.parse(J.data);null!=c&&"configure"==c.action&&(mxEvent.removeListener(window,"message",H),Editor.configure(c.config),mxSettings.load(),c.colorSchemeMeta&&mxmeta("color-scheme","dark light"),
m())}catch(e){null!=window.console&&console.log("Error in configure message: "+e,J.data)}};mxEvent.addListener(window,"message",H);N.postMessage(JSON.stringify({event:"configure"}),"*")}else{if(null==Editor.config){if(null!=window.DRAWIO_CONFIG)try{EditorUi.debug("Using global configuration",window.DRAWIO_CONFIG),Editor.configure(window.DRAWIO_CONFIG),mxSettings.load()}catch(J){null==window.console||EditorUi.isElectronApp?(mxLog.show(),mxLog.debug(J.stack)):console.error(J)}if(isLocalStorage&&null!=