Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ha=document.createElement("img");ha.setAttribute("src",ka);ha.setAttribute("alt",pa);ha.style.maxWidth=Ka+"px";ha.style.maxHeight=oa+"px";K=ha;var Xa=ka.replace(".drawio.xml","").replace(".drawio","").replace(".xml","");ra.appendChild(ha);ha.onerror=function(){this.src!=Xa?this.src=Xa:(this.src=Editor.errorImage,this.onerror=null)};mxEvent.addGestureListeners(ra,mxUtils.bind(this,function(Oa){F(ra,null,null,aa,ua,Aa)}),null,null);mxEvent.addListener(ra,"dblclick",function(Oa){L();mxEvent.consume(Oa)})}else if(!Ia&&