Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.getPngFileProperties=function(c){var e=1,g=0;if(null!=c){if(c.hasAttribute("scale")){var q=parseFloat(c.getAttribute("scale"));!isNaN(q)&&0<q&&(e=q)}c.hasAttribute("border")&&(q=parseInt(c.getAttribute("border")),!isNaN(q)&&0<q&&(g=q))}return{scale:e,border:g}};EditorUi.prototype.getEmbeddedPng=function(c,e,g,q,p){try{var t=this.editor.graph,x=null!=t.themes&&"darkTheme"==t.defaultThemeName,B=null;if(null!=g&&0<g.length)t=this.createTemporaryGraph(x?t.getDefaultStylesheet():t.getStylesheet()),