Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
F=new mxAsyncCanvas(this.thumbImageCache);L.images=this.thumbImageCache.images;var S=new mxImageExport;S.drawShape=function(p,q){p.shape instanceof mxShape&&p.shape.checkBounds()&&(q.save(),q.translate(.5,.5),p.shape.paint(q),q.translate(-.5,-.5),q.restore())};S.drawText=function(p,q){};S.drawState(x.getView().getState(x.model.root),F);F.finish(mxUtils.bind(this,function(){try{S.drawState(x.getView().getState(x.model.root),L),x!=this.editor.graph&&null!=x.container.parentNode&&x.container.parentNode.removeChild(x.container)}catch(p){M=