Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
G&&y(Editor.svgBrokenImage.src)};Q.src=k}}catch(U){y(Editor.svgBrokenImage.src)}};Editor.prototype.convertImages=function(k,y,G,P){null==P&&(P=this.createImageUrlConverter());var Q=0,U=G||{};G=mxUtils.bind(this,function(T,W){T=k.getElementsByTagName(T);for(var X=0;X<T.length;X++)mxUtils.bind(this,function(Y){try{if(null!=Y){var Z=P.convert(Y.getAttribute(W));if(null!=Z&&"data:"!=Z.substring(0,5)){var ca=U[Z];null==ca?(Q++,this.convertImageToDataUri(Z,function(ha){null!=ha&&(U[Z]=ha,Y.setAttribute(W,
ha));Q--;0==Q&&y(k)})):Y.setAttribute(W,ca)}else null!=Z&&Y.setAttribute(W,Z)}}catch(ha){}})(T[X])});G("image","xlink:href");G("img","src");0==Q&&y(k)};Editor.base64Encode=function(k){for(var y="",G=0,P=k.length,Q,U,T;G<P;){Q=k.charCodeAt(G++)&255;if(G==P){y+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(Q>>2);y+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((Q&3)<<4);y+="==";break}U=k.charCodeAt(G++);if(G==P){y+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(Q>>