Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
d.actions.addAction("testOptimize",mxUtils.bind(this,function(){q.model.beginUpdate();try{var f=q.model.cells,u=0,D=[],E=[],M;for(M in f){var k=f[M],x=q.getCurrentCellStyle(k)[mxConstants.STYLE_IMAGE];null!=x&&"data:"==x.substring(0,5)&&(null==D[x]&&(D[x]=(D[x]||0)+1,u++),E.push(k))}q.setCellStyles(mxConstants.STYLE_IMAGE,null,E);console.log("Removed",u,"image(s) from",E.length,"cell(s): ",[E,D])}finally{q.model.endUpdate()}}));d.actions.addAction("testInspect",mxUtils.bind(this,function(){console.log(d,