Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
":",m.data,function(C){null!=C&&d.spinner.spin(document.body,mxResources.get("inserting"))&&d.generatePlantUmlImage(C,m.format,function(M,ba,V){d.spinner.stop();f.getModel().beginUpdate();try{if("txt"==m.format)f.labelChanged(U,"<pre>"+M+"</pre>"),f.updateCellSize(U,!0);else{f.setCellStyles("image",d.convertDataUri(M),[U]);var Z=f.model.getGeometry(U);null!=Z&&(Z=Z.clone(),Z.width=ba,Z.height=V,f.cellsResized([U],[Z],!1))}f.setAttributeForCell(U,"plantUmlData",JSON.stringify({data:C,format:m.format}))}finally{f.getModel().endUpdate()}},