Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
e&&e(n)}}),null,null,null,mxUtils.bind(this,function(S){null!=e&&e(S)}),null,null,q,null,t.shadowVisible,null,t,p,null,null,null,"diagram",null)}catch(S){null!=e&&e(S)}};EditorUi.prototype.getEmbeddedSvg=function(c,e,g,q,p,t,x,B,I,A,S,l,n){B=null!=B?B:!0;S=null!=S?S:0;x=null!=I?I:e.background;x==mxConstants.NONE&&(x=null);t=e.getSvg(x,A,S,null,null,t,null,null,null,e.shadowVisible||l,null,n,"diagram");(e.shadowVisible||l)&&e.addSvgShadow(t,null,null,0==S);null!=c&&t.setAttribute("content",c);null!=
g&&t.setAttribute("resource",g);var z=mxUtils.bind(this,function(C){C=(q?"":Graph.xmlDeclaration+"\n"+Graph.svgFileComment+"\n"+Graph.svgDoctype+"\n")+mxUtils.getXml(C);null!=p&&p(C);return C});e.mathEnabled&&this.editor.addMathCss(t);if(null!=p)this.embedFonts(t,mxUtils.bind(this,function(C){B?this.editor.convertImages(C,mxUtils.bind(this,function(D){z(D)})):z(C)}));else return z(t)};EditorUi.prototype.embedFonts=function(c,e){this.editor.loadFonts(mxUtils.bind(this,function(){try{null!=this.editor.resolvedFontCss&&