Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ha=document.createElement("img");ha.setAttribute("src",ja);ha.setAttribute("alt",oa);ha.style.maxWidth=Qa+"px";ha.style.maxHeight=pa+"px";H=ha;var Xa=ja.replace(".drawio.xml","").replace(".drawio","").replace(".xml","");ra.appendChild(ha);ha.onerror=function(){this.src!=Xa?this.src=Xa:(this.src=Editor.errorImage,this.onerror=null)};mxEvent.addGestureListeners(ra,mxUtils.bind(this,function(Na){B(ra,null,null,aa,sa,ya)}),null,null);mxEvent.addListener(ra,"dblclick",function(Na){I();mxEvent.consume(Na)})}else if(!Ga&&