Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.editor.addFontCss(d,this.editor.resolvedFontCss),this.editor.embedExtFonts(mxUtils.bind(this,function(n){try{null!=n&&this.editor.addFontCss(d,n),g(d)}catch(t){g(d)}}))}catch(n){g(d)}}))};EditorUi.prototype.exportImage=function(d,g,n,t,u,v,A,H,L,F,S,p,q){L=null!=L?L:"png";if(this.spinner.spin(document.body,mxResources.get("exporting"))){var C=this.editor.graph.isSelectionEmpty();n=null!=n?n:C;null==this.thumbImageCache&&(this.thumbImageCache={});try{this.editor.exportToCanvas(mxUtils.bind(this,
function(J){this.spinner.stop();try{this.saveCanvas(J,u?this.getFileData(!0,null,null,null,n,H):null,L,null==this.pages||0==this.pages.length,S)}catch(G){this.handleError(G)}}),null,this.thumbImageCache,null,mxUtils.bind(this,function(J){this.spinner.stop();this.handleError(J)}),null,n,d||1,g,t,null,null,v,A,F,p,q)}catch(J){this.spinner.stop(),this.handleError(J)}}};EditorUi.prototype.isCorsEnabledForUrl=function(d){return this.editor.isCorsEnabledForUrl(d)};EditorUi.prototype.importXml=function(d,