Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(){try{null!=this.resolvedFontCss&&this.addFontCss(fa,this.resolvedFontCss),qa.src=Editor.createSvgDataUri(mxUtils.getXml(fa))}catch(ya){null!=U&&U(ya)}});this.embedExtFonts(mxUtils.bind(this,function(ya){try{null!=ya&&this.addFontCss(fa,ya),this.loadFonts(ia)}catch(xa){null!=U&&U(xa)}}))}catch(ya){null!=U&&U(ya)}}),K,Z)}catch(fa){null!=U&&U(fa)}};Editor.crcTable=[];for(var k=0;256>k;k++)for(var l=k,x=0;8>x;x++)l=1==(l&1)?3988292384^l>>>1:l>>>1,Editor.crcTable[k]=l;Editor.updateCRC=function(m,
B,K,R){for(var U=0;U<R;U++)m=Editor.crcTable[(m^B.charCodeAt(K+U))&255]^m>>>8;return m};Editor.crc32=function(m){for(var B=-1,K=0;K<m.length;K++)B=B>>>8^Editor.crcTable[(B^m.charCodeAt(K))&255];return(B^-1)>>>0};Editor.writeGraphModelToPng=function(m,B,K,R,U){function W(Z,ca){var da=X;X+=ca;return Z.substring(da,X)}function Q(Z){Z=W(Z,4);return Z.charCodeAt(3)+(Z.charCodeAt(2)<<8)+(Z.charCodeAt(1)<<16)+(Z.charCodeAt(0)<<24)}function V(Z){return String.fromCharCode(Z>>24&255,Z>>16&255,Z>>8&255,Z&255)}