Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
V,k,y,G){v=mxEvent.isAltDown(g)?v:t.getCenterInsertPoint(new mxRectangle(0,0,y,G));var P=null;t.getModel().beginUpdate();try{P="txt"==V?b.insertAsPreText(k,v.x,v.y):t.insertVertex(null,null,null,v.x,v.y,y,G,"shape=image;noLabel=1;verticalAlign=top;aspect=fixed;imageAspect=0;image="+b.convertDataUri(k)+";"),t.setAttributeForCell(P,"plantUmlData",JSON.stringify({data:O,format:V},null,2))}finally{t.getModel().endUpdate()}null!=P&&(t.setSelectionCell(P),t.scrollCellToVisible(P))},t=b.editor.graph,x="plantUmlTxt"==