Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(D.setAttribute("disabled","disabled"),z.setAttribute("disabled","disabled"));z.checked&&l.checked?n.getEditSelect().removeAttribute("disabled"):n.getEditSelect().setAttribute("disabled","disabled")});e=new CustomDialog(this,t,mxUtils.bind(this,function(){c(I.checked,A.checked,S.checked,l.checked,n.getLink(),D.checked)}),null,mxResources.get("embed"),p);this.showDialog(e.container,280,300,!0,!0)};EditorUi.prototype.createEmbedImage=function(c,e,g,q,p,t,x,B){function I(z){var C=" ",D="";q&&(C=" onclick=\"(function(img){if(img.wnd!=null&&!img.wnd.closed){img.wnd.focus();}else{var r=function(evt){if(evt.data=='ready'&&evt.source==img.wnd){img.wnd.postMessage(decodeURIComponent(img.getAttribute('src')),'*');window.removeEventListener('message',r);}};window.addEventListener('message',r);img.wnd=window.open('"+
EditorUi.lightboxHost+"/?client=1"+(null!=S?"&page="+S:"")+(p?"&edit=_blank":"")+(t?"&layers=1":"")+"');}})(this);\"",D+="cursor:pointer;");c&&(D+="max-width:100%;");var M="";g&&(M=' width="'+Math.round(A.width)+'" height="'+Math.round(A.height)+'"');x('<img src="'+z+'"'+M+(""!=D?' style="'+D+'"':"")+C+"/>")}var A=this.editor.graph.getGraphBounds(),S=this.getSelectedPageIndex();if(this.isExportToCanvas())this.editor.exportToCanvas(mxUtils.bind(this,function(z){var C=q?this.getFileData(!0):null;z=