Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.getPngFileProperties=function(d){var g=1,n=0;if(null!=d){if(d.hasAttribute("scale")){var t=parseFloat(d.getAttribute("scale"));!isNaN(t)&&0<t&&(g=t)}d.hasAttribute("border")&&(t=parseInt(d.getAttribute("border")),!isNaN(t)&&0<t&&(n=t))}return{scale:g,border:n}};EditorUi.prototype.getEmbeddedPng=function(d,g,n,t,u){try{var v=this.editor.graph,A=null!=v.themes&&"darkTheme"==v.defaultThemeName,H=null;if(null!=n&&0<n.length)v=this.createTemporaryGraph(A?v.getDefaultStylesheet():v.getStylesheet()),