Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
A);this.showDialog(f.container,280,300,!0,!0)};EditorUi.prototype.createEmbedImage=function(d,f,l,u,A,B,F,M){function O(ia){var ma=" ",aa="";u&&(ma=" onclick=\"(function(img){if(img.wnd!=null&&!img.wnd.closed){img.wnd.focus();}else{var r=function(evt){if(evt.data=='ready'&&evt.source==img.wnd){img.wnd.postMessage(decodeURIComponent(img.getAttribute('src')),'*');window.removeEventListener('message',r);}};window.addEventListener('message',r);img.wnd=window.open('"+EditorUi.lightboxHost+"/?client=1"+
(null!=ja?"&page="+ja:"")+(A?"&edit=_blank":"")+(B?"&layers=1":"")+"');}})(this);\"",aa+="cursor:pointer;");d&&(aa+="max-width:100%;");var la="";l&&(la=' width="'+Math.round(H.width)+'" height="'+Math.round(H.height)+'"');F('<img src="'+ia+'"'+la+(""!=aa?' style="'+aa+'"':"")+ma+"/>")}var H=this.editor.graph.getGraphBounds(),ja=this.getSelectedPageIndex();if(this.isExportToCanvas())this.editor.exportToCanvas(mxUtils.bind(this,function(ia){var ma=u?this.getFileData(!0):null;ia=this.createImageDataUri(ia,