Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
c="data:image/jpeg;base64,"+c:/\.gif$/i.test(f)?c="data:image/gif;base64,"+c:/\.pdf$/i.test(f)?c="data:application/pdf;base64,"+c:/\.png$/i.test(f)?(e=this.ui.extractGraphModelFromPng(c),c=null!=e&&0<e.length?e:"data:image/png;base64,"+c):c=Base64.decode(c));return c};GitLabClient.prototype.createGitLabFile=function(e,f,c,k,l,x){var y=DRAWIO_GITLAB_URL+"/";e={org:e,repo:f,ref:c,name:k.file_name,path:k.file_path,html_url:y+e+"/"+f+"/blob/"+c+"/"+k.file_path,download_url:y+e+"/"+f+"/raw/"+c+"/"+k.file_path+
"?inline=false",last_commit_id:k.last_commit_id,refPos:x};k=this.getFileContent(k);return l?new GitLabLibrary(this.ui,k,e):new GitLabFile(this.ui,k,e)};GitLabClient.prototype.insertFile=function(e,f,c,k,l,x,y){l=null!=l?l:!1;x=x.split("/");this.getRefIndex(x,!0,mxUtils.bind(this,function(E,D){var z=Math.max(D-1,0),M=E.slice(0,z).join("/"),I=E[z],d=E[D];path=E.slice(D+1,E.length).join("/");0<path.length&&(path+="/");path+=e;this.checkExists(M+"/"+I+"/"+d+"/"+path,!0,mxUtils.bind(this,function(g,n){g?