Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.bind(this,function(O,N){O=null!=g.backgroundImage?g.backgroundImage.originalSrc:null;if(null!=O){var T=O.indexOf(",");if(0<T)for(O=O.substring(T+1),N=N.getProperty("patches"),T=0;T<N.length;T++)if(null!=N[T][EditorUi.DIFF_UPDATE]&&null!=N[T][EditorUi.DIFF_UPDATE][O]||null!=N[T][EditorUi.DIFF_REMOVE]&&0<=mxUtils.indexOf(N[T][EditorUi.DIFF_REMOVE],O)){g.refreshBackgroundImage();break}}}));var v=g.getBackgroundImageObject;g.getBackgroundImageObject=function(O,N){var T=v.apply(this,arguments);
if(null!=T&&null!=T.originalSrc)if(!N)T={src:T.originalSrc};else if(N&&null!=this.themes&&"darkTheme"==this.defaultThemeName){var m=this.stylesheet,B=this.shapeForegroundColor,K=this.shapeBackgroundColor;this.stylesheet=this.getDefaultStylesheet();this.shapeBackgroundColor="#ffffff";this.shapeForegroundColor="#000000";T=d.createImageForPageLink(T.originalSrc);this.shapeBackgroundColor=K;this.shapeForegroundColor=B;this.stylesheet=m}return T};this.isOffline()||"undefined"===typeof window.EditDataDialog||