Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
A,M,Q){for(var U=0;U<Q;U++)m=Editor.crcTable[(m^A.charCodeAt(M+U))&255]^m>>>8;return m};Editor.crc32=function(m){for(var A=-1,M=0;M<m.length;M++)A=A>>>8^Editor.crcTable[(A^m.charCodeAt(M))&255];return(A^-1)>>>0};Editor.writeGraphModelToPng=function(m,A,M,Q,U){function W(Z,da){var ba=X;X+=da;return Z.substring(ba,X)}function P(Z){Z=W(Z,4);return Z.charCodeAt(3)+(Z.charCodeAt(2)<<8)+(Z.charCodeAt(1)<<16)+(Z.charCodeAt(0)<<24)}function V(Z){return String.fromCharCode(Z>>24&255,Z>>16&255,Z>>8&255,Z&255)}
m=m.substring(m.indexOf(",")+1);m=window.atob?atob(m):Base64.decode(m,!0);var X=0;if(W(m,8)!=String.fromCharCode(137)+"PNG"+String.fromCharCode(13,10,26,10))null!=U&&U();else if(W(m,4),"IHDR"!=W(m,4))null!=U&&U();else{W(m,17);U=m.substring(0,X);do{var Y=P(m);if("IDAT"==W(m,4)){U=m.substring(0,X-8);"pHYs"==A&&"dpi"==M?(M=Math.round(Q/.0254),M=V(M)+V(M)+String.fromCharCode(1)):M=M+String.fromCharCode(0)+("zTXt"==A?String.fromCharCode(0):"")+Q;Q=4294967295;Q=Editor.updateCRC(Q,A,0,4);Q=Editor.updateCRC(Q,
M,0,M.length);U+=V(M.length)+A+M+V(Q^4294967295);U+=m.substring(X-8,m.length);break}U+=m.substring(X-8,X-4+Y);W(m,Y);W(m,4)}while(Y);return"data:image/png;base64,"+(window.btoa?btoa(U):Base64.encode(U,!0))}};if(window.ColorDialog){FilenameDialog.filenameHelpLink="https://www.drawio.com/doc/faq/save-file-formats";var y=ColorDialog.addRecentColor;ColorDialog.addRecentColor=function(m,A){y.apply(this,arguments);mxSettings.setRecentColors(ColorDialog.recentColors);mxSettings.save()};var E=ColorDialog.resetRecentColors;