Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"data:"+d+";base64,"+L);k.style.position="absolute";k.style.top="70px";k.style.right="100px";k.style.maxWidth="120px";k.style.maxHeight="80px";mxUtils.setPrefixedStyle(k.style,"transform","translate(50%,-50%)");l.appendChild(k);mxClient.IS_FF||"image/png"!=d||null==navigator.clipboard||"function"!==typeof window.ClipboardItem||(n=mxUtils.button(mxResources.get("copy"),function(q){q=b.base64ToBlob(L,"image/png");q=new ClipboardItem({"image/png":q,"text/html":new Blob(['<img src="data:'+d+";base64,"+
L+'">'],{type:"text/html"})});navigator.clipboard.write([q]).then(mxUtils.bind(this,function(){b.alert(mxResources.get("copiedToClipboard"))}))["catch"](mxUtils.bind(this,function(C){b.handleError(C)}))}),n.style.marginTop="6px",n.className="geBtn");E&&Editor.popupsAllowed&&(k.style.cursor="pointer",mxEvent.addGestureListeners(k,null,null,function(q){mxEvent.isPopupTrigger(q)||v("_blank")}))}mxUtils.br(l);var F=document.createElement("div");F.style.textAlign="center";var S=0;F.style.marginTop="6px";