Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
va.extFonts=$a.viewState.extFonts);null!=db&&null!=db.originalSrc&&(db=l.createImageForPageLink(db.originalSrc,$a));va.background=Ra;va.backgroundImage=null!=db?new mxImage(db.src,db.width,db.height,db.x,db.y):null;va.pageVisible=Fa;va.mathEnabled=Na;var lb=va.getGraphBounds;va.getGraphBounds=function(){var Pa=lb.apply(this,arguments),eb=this.backgroundImage;if(null!=eb&&null!=eb.width&&null!=eb.height){var jb=this.view.translate,ib=this.view.scale;Pa=mxRectangle.fromRectangle(Pa);Pa.add(new mxRectangle((jb.x+
eb.x)*ib,(jb.y+eb.y)*ib,eb.width*ib,eb.height*ib))}return Pa};var kb=va.getGlobalVariable;va.getGlobalVariable=function(Pa){return"page"==Pa?$a.getName():"pagenumber"==Pa?bb+1:"pagecount"==Pa?null!=l.pages?l.pages.length:1:kb.apply(this,arguments)};document.body.appendChild(va.container);l.updatePageRoot($a);va.model.setRoot($a.root)}ab=ea(va,ab,bb!=Ua,$a.getId());va!=U&&va.container.parentNode.removeChild(va.container)}}else ab=ea(U);null==ab?l.handleError({message:mxResources.get("errorUpdatingPreview")}):