Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"defs"):ba.createElement("defs"),null!=m.firstChild?m.insertBefore(M,m.firstChild):m.appendChild(M)):M=M[0];m=null!=ba.createElementNS?ba.createElementNS(mxConstants.NS_SVG,"style"):ba.createElement("style");m.setAttribute("type","text/css");mxUtils.setTextContent(m,C);M.appendChild(m)}};Editor.prototype.isExportToCanvas=function(){return mxClient.IS_CHROMEAPP||this.useCanvasForExport};Editor.prototype.getMaxCanvasScale=function(m,C,M){var ba=mxClient.IS_FF?8192:16384;return Math.min(M,Math.min(ba/
m,ba/C))};Editor.prototype.exportToCanvas=function(m,C,M,ba,V,Z,aa,ka,qa,ra,pa,wa,Da,Ba,ya,Oa,Qa,Ta){try{Z=null!=Z?Z:!0;aa=null!=aa?aa:!0;wa=null!=wa?wa:this.graph;Da=null!=Da?Da:0;var ta=qa?null:wa.background;ta==mxConstants.NONE&&(ta=null);null==ta&&(ta=ba);null==ta&&0==qa&&(ta=Oa?this.graph.defaultPageBackgroundColor:"#ffffff");this.convertImages(wa.getSvg(null,null,Da,Ba,null,aa,null,null,null,ra,null,Oa,Qa,Ta),mxUtils.bind(this,function(Aa){try{var Ea=new Image;Ea.onload=mxUtils.bind(this,function(){try{var Va=