Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.getPngFileProperties=function(d){var f=1,l=0;if(null!=d){if(d.hasAttribute("scale")){var u=parseFloat(d.getAttribute("scale"));!isNaN(u)&&0<u&&(f=u)}d.hasAttribute("border")&&(u=parseInt(d.getAttribute("border")),!isNaN(u)&&0<u&&(l=u))}return{scale:f,border:l}};EditorUi.prototype.getEmbeddedPng=function(d,f,l,u,A){try{var B=this.editor.graph,F=null!=B.themes&&"darkTheme"==B.defaultThemeName,M=null;if(null!=l&&0<l.length)B=this.createTemporaryGraph(F?B.getDefaultStylesheet():B.getStylesheet()),