Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
eb.x)*ib,(jb.y+eb.y)*ib,eb.width*ib,eb.height*ib))}return Pa};var kb=va.getGlobalVariable;va.getGlobalVariable=function(Pa){return"page"==Pa?$a.getName():"pagenumber"==Pa?bb+1:"pagecount"==Pa?null!=l.pages?l.pages.length:1:kb.apply(this,arguments)};document.body.appendChild(va.container);l.updatePageRoot($a);va.model.setRoot($a.root)}ab=ea(va,ab,bb!=Ua,$a.getId());va!=U&&va.container.parentNode.removeChild(va.container)}}else ab=ea(U);null==ab?l.handleError({message:mxResources.get("errorUpdatingPreview")}):
(ab.mathEnabled&&(Ua=ab.wnd.document,X&&(ab.wnd.IMMEDIATE_PRINT=!0),Ua.writeln('<script type="text/javascript" src="'+DRAWIO_BASE_URL+'/js/math-print.js">\x3c/script>')),ab.closeDocument(),Graph.rewritePageLinks(ab.wnd.document),!ab.mathEnabled&&X&&PrintDialog.printPreview(ab));null!=oa&&(U.shapeForegroundColor=xa,U.shapeBackgroundColor=sa,U.stylesheet=oa,U.refresh())}}var U=l.editor.graph,aa=document.createElement("div"),Y=document.createElement("h3");Y.style.width="100%";Y.style.textAlign="center";