Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
A=new mxAsyncCanvas(this.thumbImageCache);I.images=this.thumbImageCache.images;var S=new mxImageExport;S.drawShape=function(l,n){l.shape instanceof mxShape&&l.shape.checkBounds()&&(n.save(),n.translate(.5,.5),l.shape.paint(n),n.translate(-.5,-.5),n.restore())};S.drawText=function(l,n){};S.drawState(E.getView().getState(E.model.root),A);A.finish(mxUtils.bind(this,function(){try{S.drawState(E.getView().getState(E.model.root),I),E!=this.editor.graph&&null!=E.container.parentNode&&E.container.parentNode.removeChild(E.container)}catch(l){R=