Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"/txt/":"png"==e?PLANT_URL+"/png/":PLANT_URL+"/svg/")+function(C){r="";for(i=0;i<C.length;i+=3)r=i+2==C.length?r+p(C.charCodeAt(i),C.charCodeAt(i+1),0):i+1==C.length?r+p(C.charCodeAt(i),0,0):r+p(C.charCodeAt(i),C.charCodeAt(i+1),C.charCodeAt(i+2));return r}(Graph.arrayBufferToString(pako.deflateRaw(c))),!0);"txt"!=e&&(x.responseType="blob");x.onload=function(C){if(200<=this.status&&300>this.status)if("txt"==e)k(this.response);else{var I=new FileReader;I.readAsDataURL(this.response);I.onloadend=function(B){var T=
new Image;T.onload=function(){try{var l=T.width,n=T.height;if(0==l&&0==n){var z=I.result,E=z.indexOf(","),A=decodeURIComponent(escape(atob(z.substring(E+1)))),N=mxUtils.parseXml(A).getElementsByTagName("svg");0<N.length&&(l=parseFloat(N[0].getAttribute("width")),n=parseFloat(N[0].getAttribute("height")))}k(I.result,l,n)}catch(Q){q(Q)}};T.src=I.result};I.onerror=function(B){q(B)}}else q(C)};x.onerror=function(C){q(C)};x.send()};EditorUi.prototype.insertAsPreText=function(c,e,k){var q=this.editor.graph,