Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ma.width=ja;ma.height=fa;var da=ma.toDataURL();ia!==da&&(f=ia,J=ja,O=fa)}}}catch(S){}k(f,J,O)};EditorUi.prototype.extractGraphModelFromPng=function(d){return Editor.extractGraphModelFromPng(d)};EditorUi.prototype.loadImage=function(d,f,k){try{var v=new Image;v.onload=function(){v.width=0<v.width?v.width:120;v.height=0<v.height?v.height:120;f(v)};null!=k&&(v.onerror=k);v.src=d}catch(z){if(null!=k)k(z);else throw z;}};EditorUi.prototype.getDefaultSketchMode=function(){var d="1"==urlParams.sketch;return"0"!=