Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
na=la;ca=ma;ha=ja;ea=aa;za=oa;Ca=sa;Ba=fa;ea.style.backgroundColor=F;ea.style.border=L}function S(aa,la,ma,oa,fa,ja,sa,ta,La,Ga,ya){function Ja(Na,Ya){null==Fa?(Ka=Na,Ka=/^https?:\/\//.test(Ka)&&!b.editor.isCorsEnabledForUrl(Ka)?PROXY_URL+"?url="+encodeURIComponent(Ka):TEMPLATE_PATH+"/"+Ka,mxUtils.get(Ka,mxUtils.bind(this,function(Wa){200<=Wa.getStatus()&&299>=Wa.getStatus()&&(Fa=Wa.getText());Ya(Fa,Ka)}))):Ya(Fa,Ka)}function Ma(Na,Ya){if(null==aa||y||b.sidebar.currentElt==ra)b.sidebar.hideTooltip();
else if(b.sidebar.hideTooltip(),null!=G){var Wa="<mxfile><diagram>"+Graph.compress('<mxGraphModel><root><mxCell id="0"/><mxCell id="1" parent="0"/><mxCell id="2" value="" style="shape=image;image='+G.src+';imageAspect=1;" parent="1" vertex="1"><mxGeometry width="'+G.naturalWidth+'" height="'+G.naturalHeight+'" as="geometry" /></mxCell></root></mxGraphModel>')+"</diagram></mxfile>";x(Wa,mxEvent.getClientX(Na),mxEvent.getClientY(Na),ma,aa)}else b.sidebar.currentElt=ra,y=!0,Ja(aa,function(ab){y&&b.sidebar.currentElt==
ra&&x(ab,mxEvent.getClientX(Na),mxEvent.getClientY(Na),ra,Ya);y=!1})}var ra=document.createElement("div");ra.className="geTemplate geAdaptiveAsset";ra.style.position="relative";ra.style.height=Qa+"px";ra.style.width=pa+"px";ra.style.border="1px solid transparent";var Fa=null,Ka=aa;null!=ma?ra.setAttribute("title",mxResources.get(ma,null,ma)):null!=oa&&0<oa.length&&ra.setAttribute("title",oa);if(null!=ja){ra.style.display="inline-flex";ra.style.justifyContent="center";ra.style.alignItems="center";