Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
O("image","xlink:href");O("img","src");0==U&&A(l)};Editor.base64Encode=function(l){for(var A="",O=0,X=l.length,U,aa,ba;O<X;){U=l.charCodeAt(O++)&255;if(O==X){A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(U>>2);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((U&3)<<4);A+="==";break}aa=l.charCodeAt(O++);if(O==X){A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(U>>2);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((U&
3)<<4|(aa&240)>>4);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((aa&15)<<2);A+="=";break}ba=l.charCodeAt(O++);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(U>>2);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((U&3)<<4|(aa&240)>>4);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((aa&15)<<2|(ba&192)>>6);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(ba&
63)}return A};Editor.prototype.loadUrl=function(l,A,O,X,U,aa,ba,ia){try{var qa=!ba&&(X||/(\.png)($|\?)/i.test(l)||/(\.jpe?g)($|\?)/i.test(l)||/(\.gif)($|\?)/i.test(l)||/(\.pdf)($|\?)/i.test(l));U=null!=U?U:!0;var ra=mxUtils.bind(this,function(){mxUtils.get(l,mxUtils.bind(this,function(pa){if(200<=pa.getStatus()&&299>=pa.getStatus()){if(null!=A){var xa=pa.getText();if(qa){if((9==document.documentMode||10==document.documentMode)&&"undefined"!==typeof window.mxUtilsBinaryToArray){pa=mxUtilsBinaryToArray(pa.request.responseBody).toArray();