Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!1,null);document.execCommand("copy");this.alert(mxResources.get("copiedToClipboard"));u.value=B}catch(F){this.handleError(F)}}));A.setAttribute("title","copy");A.className="geBtn";l.appendChild(A)}),!0,null,null,"https://www.drawio.com/doc/faq/apply-layouts");this.showDialog(f.container,620,460,!0,!0);f.init()}))};EditorUi.prototype.loadOrgChartLayouts=function(d){this.createTimeout(null,mxUtils.bind(this,function(f){var l=mxUtils.bind(this,function(){this.loadingOrgChart=!1;f.clear()&&(Graph.layoutNames.push("mxOrgChartLayout"),
this.spinner.stop(),d())}),u=mxUtils.bind(this,function(A){this.loadingOrgChart=!1;f.clear()&&this.handleError(A)});"undefined"!==typeof mxOrgChartLayout||this.loadingOrgChart||this.isOffline(!0)?l():this.spinner.spin(document.body,mxResources.get("loading"))&&(this.loadingOrgChart=!0,"1"==urlParams.dev?mxscript("js/orgchart/bridge.min.js",function(){mxscript("js/orgchart/bridge.collections.min.js",function(){mxscript("js/orgchart/OrgChart.Layout.min.js",function(){mxscript("js/orgchart/mxOrgChartLayout.js",
l,null,null,null,u)},null,null,null,u)},null,null,null,u)},null,null,null,u):mxscript(DRAWIO_BASE_URL+"/js/orgchart.min.js",l,null,null,null,u))}),onerror)};EditorUi.prototype.importCsv=function(d,f){this.loadOrgChartLayouts(mxUtils.bind(this,function(){this.doImportCsv(d,f)}))};EditorUi.prototype.doImportCsv=function(d,f){try{var l=d.split("\n"),u=[],A=[],B=[],F={};if(0<l.length){var M={},O=this.editor.graph,H=null,ja=null,da=null,ca=null,ia=null,ma=null,aa=null,la="whiteSpace=wrap;html=1;",X=null,