Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
'<img src="'+(l.constructor!=DriveFile?n:"https://drive.google.com/uc?id="+l.getId())+'"/>'),d.showDialog(n.container,450,240,!0,!0),n.init()):d.handleError({message:mxResources.get("invalidPublicUrl")})})}));d.actions.put("embedImage",new Action(mxResources.get("image")+"...",function(){d.showEmbedImageDialog(function(l,n,z,C,D,M){d.spinner.spin(document.body,mxResources.get("loading"))&&d.createEmbedImage(l,n,z,C,D,M,function(K){d.spinner.stop();K=new EmbedDialog(d,K);d.showDialog(K.container,450,