Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(y){c.spinner.stop();null!=y?(y=new EmbedDialog(c,'<img src="'+(l.constructor!=DriveFile?y:"https://drive.google.com/uc?id="+l.getId())+'"/>'),c.showDialog(y.container,450,240,!0,!0),y.init()):c.handleError({message:mxResources.get("invalidPublicUrl")})})}));c.actions.put("embedImage",new Action(mxResources.get("image")+"...",function(){c.showEmbedImageDialog(function(l,y,J,G,P,p){c.spinner.spin(document.body,mxResources.get("loading"))&&c.createEmbedImage(l,y,J,G,P,p,function(z){c.spinner.stop();