Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!0,!0,null,null,null,null,!0);C.focus();mxClient.IS_GC||mxClient.IS_FF||5<=document.documentMode?C.select():document.execCommand("selectAll",!1,null)};EditorUi.prototype.showEmbedImageDialog=function(d,g,n,t,u){var v=document.createElement("div");v.style.whiteSpace="nowrap";var A=this.editor.graph;if(null!=g){var H=document.createElement("h3");mxUtils.write(H,g);H.style.cssText="width:100%;text-align:center;margin-top:0px;margin-bottom:4px";v.appendChild(H)}var L=this.addCheckbox(v,mxResources.get("fit"),
!0),F=this.addCheckbox(v,mxResources.get("shadow"),A.shadowVisible&&t,!t),S=this.addCheckbox(v,n),p=this.addCheckbox(v,mxResources.get("lightbox"),!0),q=this.addEditButton(v,p),C=q.getEditInput(),J=1<A.model.getChildCount(A.model.getRoot()),G=this.addCheckbox(v,mxResources.get("layers"),J,!J);G.style.marginLeft=C.style.marginLeft;G.style.marginBottom="12px";G.style.marginTop="8px";mxEvent.addListener(p,"change",function(){p.checked?(J&&G.removeAttribute("disabled"),C.removeAttribute("disabled")):
(G.setAttribute("disabled","disabled"),C.setAttribute("disabled","disabled"));C.checked&&p.checked?q.getEditSelect().removeAttribute("disabled"):q.getEditSelect().setAttribute("disabled","disabled")});g=new CustomDialog(this,v,mxUtils.bind(this,function(){d(L.checked,F.checked,S.checked,p.checked,q.getLink(),G.checked)}),null,mxResources.get("embed"),u);this.showDialog(g.container,280,300,!0,!0)};EditorUi.prototype.createEmbedImage=function(d,g,n,t,u,v,A,H){function L(C){var J=" ",G="";t&&(J=" onclick=\"(function(img){if(img.wnd!=null&&!img.wnd.closed){img.wnd.focus();}else{var r=function(evt){if(evt.data=='ready'&&evt.source==img.wnd){img.wnd.postMessage(decodeURIComponent(img.getAttribute('src')),'*');window.removeEventListener('message',r);}};window.addEventListener('message',r);img.wnd=window.open('"+