Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(Da){null!=Da&&(Z[pa]=Da,ra.setAttribute(ka,Da));V--;0==V&&C(m)})):ra.setAttribute(ka,wa)}else null!=pa&&ra.setAttribute(ka,pa)}}catch(Da){}})(aa[qa])});M("image","xlink:href");M("img","src");0==V&&C(m)};Editor.base64Encode=function(m){for(var C="",M=0,ba=m.length,V,Z,aa;M<ba;){V=m.charCodeAt(M++)&255;if(M==ba){C+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(V>>2);C+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((V&3)<<4);C+="==";break}Z=
m.charCodeAt(M++);if(M==ba){C+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(V>>2);C+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((V&3)<<4|(Z&240)>>4);C+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((Z&15)<<2);C+="=";break}aa=m.charCodeAt(M++);C+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(V>>2);C+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((V&3)<<4|(Z&
240)>>4);C+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((Z&15)<<2|(aa&192)>>6);C+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(aa&63)}return C};Editor.prototype.loadUrl=function(m,C,M,ba,V,Z,aa,ka){try{var qa=!aa&&(ba||/(\.png)($|\?)/i.test(m)||/(\.jpe?g)($|\?)/i.test(m)||/(\.gif)($|\?)/i.test(m)||/(\.pdf)($|\?)/i.test(m));V=null!=V?V:!0;var ra=mxUtils.bind(this,function(){mxUtils.get(m,mxUtils.bind(this,function(pa){if(200<=pa.getStatus()&&