Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
'<img src="'+(p.constructor!=DriveFile?q:"https://drive.google.com/uc?id="+p.getId())+'"/>'),c.showDialog(q.container,450,240,!0,!0),q.init()):c.handleError({message:mxResources.get("invalidPublicUrl")})})}));c.actions.put("embedImage",new Action(mxResources.get("image")+"...",function(){c.showEmbedImageDialog(function(p,q,C,J,G,P){c.spinner.spin(document.body,mxResources.get("loading"))&&c.createEmbedImage(p,q,C,J,G,P,function(O){c.spinner.stop();O=new EmbedDialog(c,O);c.showDialog(O.container,450,