Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"").replace(/ (NS xml|\S*):space="preserve"/g,' xml:space="preserve"');var G=mxUtils.parseXml(L).getElementsByTagName("svg");if(0<G.length&&"error"!=G[0].getAttribute("aria-roledescription")){var T=parseFloat(G[0].getAttribute("width")),p=parseFloat(G[0].getAttribute("height"));if(isNaN(T)||isNaN(p))try{var q=G[0].getAttribute("viewBox").split(/\s+/);T=parseFloat(q[2]);p=parseFloat(q[3])}catch(C){T=T||100,p=p||100}n(this.convertDataUri(Editor.createSvgDataUri(L)),T,p)}else null!=u?u():t({message:mxResources.get("invalidInput")})}catch(C){t(C)}});