Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"").replace(/ (NS xml|\S*):space="preserve"/g,' xml:space="preserve"');var F=mxUtils.parseXml(L).getElementsByTagName("svg");if(0<F.length&&"error"!=F[0].getAttribute("aria-roledescription")){var S=parseFloat(F[0].getAttribute("width")),p=parseFloat(F[0].getAttribute("height"));if(isNaN(S)||isNaN(p))try{var q=F[0].getAttribute("viewBox").split(/\s+/);S=parseFloat(q[2]);p=parseFloat(q[3])}catch(C){S=S||100,p=p||100}n(this.convertDataUri(Editor.createSvgDataUri(L)),S,p)}else null!=u?u():t({message:mxResources.get("invalidInput")})}catch(C){t(C)}});