Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
FilenameDialog.createFileTypes=function(b,e,g){var n=document.createElement("select");for(b=0;b<g.length;b++){var y=document.createElement("option");y.setAttribute("value",b);mxUtils.write(y,mxResources.get(g[b].description)+" (."+g[b].extension+")");n.appendChild(y)}mxEvent.addListener(n,"change",function(q){q=g[n.value].extension;var E=e.value.lastIndexOf(".drawio.");E=0<E?E:e.value.lastIndexOf(".");"drawio"!=q&&(q="drawio."+q);e.value=0<E?e.value.substring(0,E+1)+q:e.value+"."+q;"createEvent"in
document?(q=document.createEvent("HTMLEvents"),q.initEvent("change",!1,!0),e.dispatchEvent(q)):e.fireEvent("onchange")});b=function(q){q=e.value.toLowerCase();for(var E=0,N=0;N<g.length;N++){var T=g[N].extension,F=null;"drawio"!=T&&(F=T,T=".drawio."+T);if(q.substring(q.length-T.length-1)=="."+T||null!=F&&q.substring(q.length-F.length-1)=="."+F){E=N;break}}n.value=E};mxEvent.addListener(e,"change",b);mxEvent.addListener(e,"keyup",b);b();return n};