Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
'<img src="'+(l.constructor!=DriveFile?n:"https://drive.google.com/uc?id="+l.getId())+'"/>'),d.showDialog(n.container,450,240,!0,!0),n.init()):d.handleError({message:mxResources.get("invalidPublicUrl")})})}));d.actions.put("embedImage",new Action(mxResources.get("image")+"...",function(){d.showEmbedImageDialog(function(l,n,z,E,A,N){d.spinner.spin(document.body,mxResources.get("loading"))&&d.createEmbedImage(l,n,z,E,A,N,function(Q){d.spinner.stop();Q=new EmbedDialog(d,Q);d.showDialog(Q.container,450,