Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
document.createElement("canvas");C.width=S;C.height=l;var D=C.toDataURL();z!==D&&(e=z,B=S,I=l)}}}catch(M){}g(e,B,I)};EditorUi.prototype.extractGraphModelFromPng=function(c){return Editor.extractGraphModelFromPng(c)};EditorUi.prototype.loadImage=function(c,e,g){try{var q=new Image;q.onload=function(){q.width=0<q.width?q.width:120;q.height=0<q.height?q.height:120;e(q)};null!=g&&(q.onerror=g);q.src=c}catch(p){if(null!=g)g(p);else throw p;}};EditorUi.prototype.getDefaultSketchMode=function(){var c="1"==
urlParams.sketch;return"0"!=(null!=urlParams.rough?urlParams.rough:c)};var u=EditorUi.prototype.createUi;EditorUi.prototype.createUi=function(){Editor.isSettingsEnabled()&&(this.doSetSketchMode(null!=mxSettings.settings.sketchMode&&null==urlParams.rough&&null==urlParams.sketch?mxSettings.settings.sketchMode:this.getDefaultSketchMode()),null!=mxSettings.settings.sidebarTitles&&(Sidebar.prototype.sidebarTitles=mxSettings.settings.sidebarTitles),this.formatWidth=mxSettings.getFormatWidth());u.apply(this,