Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
0,0);L=H.toDataURL("image/jpeg");k[O]=L.substr(23);x++;z()}):J.async("base64").then(function(L){k[O]=L;x++;z()}))})},function(E){null!=c&&c(E)})};m.prototype.createMxGraph=function(){var g=new Graph;g.setExtendParents(!1);g.setExtendParentsOnAdd(!1);g.setConstrainChildren(!1);g.setHtmlLabels(!0);g.getModel().maintainEdgeParent=!1;return g};m.prototype.processPage=function(g,b){g=(new mxCodec).encode(g.getModel());g.setAttribute("style","default-style2");g=mxUtils.getXml(g);var a="";if(null!=b){var c=
mxUtils.htmlEntities(b.getPageName())+(b.isBackground()?" (Background)":"");b=mxUtils.htmlEntities(b.getPageNameU());a+='<diagram name="'+c+'" id="'+b.replace(/\s/g,"_")+'">'}return a+=Graph.compress(g)};m.prototype.scalePoint=function(g,b){null!=g&&(g.x*=b,g.y*=b);return g};m.prototype.scaleRect=function(g,b){null!=g&&(g.x*=b,g.y*=b,g.height*=b,g.width*=b);return g};m.prototype.importNodes=function(g,b,a,c){var d=a.lastIndexOf("/"),f=a,k=a;if(-1!==d&&(f=a.substring(0,d),k=a.substring(d+1,a.length),