Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(){try{null!=this.resolvedFontCss&&this.addFontCss(da,this.resolvedFontCss),qa.src=Editor.createSvgDataUri(mxUtils.getXml(da))}catch(Aa){null!=Q&&Q(Aa)}});this.embedExtFonts(mxUtils.bind(this,function(Aa){try{null!=Aa&&this.addFontCss(da,Aa),this.loadFonts(ka)}catch(xa){null!=Q&&Q(xa)}}))}catch(Aa){null!=Q&&Q(Aa)}}),G,Z)}catch(da){null!=Q&&Q(da)}};Editor.crcTable=[];for(var u=0;256>u;u++)for(var v=u,E=0;8>E;E++)v=1==(v&1)?3988292384^v>>>1:v>>>1,Editor.crcTable[u]=v;Editor.updateCRC=function(k,
y,G,P){for(var Q=0;Q<P;Q++)k=Editor.crcTable[(k^y.charCodeAt(G+Q))&255]^k>>>8;return k};Editor.crc32=function(k){for(var y=-1,G=0;G<k.length;G++)y=y>>>8^Editor.crcTable[(y^k.charCodeAt(G))&255];return(y^-1)>>>0};Editor.writeGraphModelToPng=function(k,y,G,P,Q){function U(Z,ca){var ha=X;X+=ca;return Z.substring(ha,X)}function T(Z){Z=U(Z,4);return Z.charCodeAt(3)+(Z.charCodeAt(2)<<8)+(Z.charCodeAt(1)<<16)+(Z.charCodeAt(0)<<24)}function W(Z){return String.fromCharCode(Z>>24&255,Z>>16&255,Z>>8&255,Z&255)}