Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ba));U--;0==U&&A(m)})):Y.setAttribute(V,da)}else null!=Z&&Y.setAttribute(V,Z)}}catch(ba){}})(P[X])});M("image","xlink:href");M("img","src");0==U&&A(m)};Editor.base64Encode=function(m){for(var A="",M=0,Q=m.length,U,W,P;M<Q;){U=m.charCodeAt(M++)&255;if(M==Q){A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(U>>2);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((U&3)<<4);A+="==";break}W=m.charCodeAt(M++);if(M==Q){A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(U>>
2);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((U&3)<<4|(W&240)>>4);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((W&15)<<2);A+="=";break}P=m.charCodeAt(M++);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(U>>2);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((U&3)<<4|(W&240)>>4);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((W&15)<<2|(P&192)>>6);
A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(P&63)}return A};Editor.prototype.loadUrl=function(m,A,M,Q,U,W,P,V){try{var X=!P&&(Q||/(\.png)($|\?)/i.test(m)||/(\.jpe?g)($|\?)/i.test(m)||/(\.gif)($|\?)/i.test(m)||/(\.pdf)($|\?)/i.test(m));U=null!=U?U:!0;var Y=mxUtils.bind(this,function(){mxUtils.get(m,mxUtils.bind(this,function(Z){if(200<=Z.getStatus()&&299>=Z.getStatus()){if(null!=A){var da=Z.getText();if(X){if((9==document.documentMode||10==document.documentMode)&&"undefined"!==