Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null!=ta?new mxImage(ta.src,ta.width,ta.height,ta.x,ta.y):null;ia.pageVisible=aa;ia.mathEnabled=oa;var La=ia.getGraphBounds;ia.getGraphBounds=function(){var ya=La.apply(this,arguments),Ja=this.backgroundImage;if(null!=Ja&&null!=Ja.width&&null!=Ja.height){var Ma=this.view.translate,ra=this.view.scale;ya=mxRectangle.fromRectangle(ya);ya.add(new mxRectangle((Ma.x+Ja.x)*ra,(Ma.y+Ja.y)*ra,Ja.width*ra,Ja.height*ra))}return ya};var Ga=ia.getGlobalVariable;ia.getGlobalVariable=function(ya){return"page"==
ya?ja.getName():"pagenumber"==ya?fa+1:"pagecount"==ya?null!=k.pages?k.pages.length:1:Ga.apply(this,arguments)};document.body.appendChild(ia.container);k.updatePageRoot(ja);ia.model.setRoot(ja.root)}ma=Ia(ia,ma,fa!=la,ja.getId());ia!=Q&&ia.container.parentNode.removeChild(ia.container)}}else ma=Ia(Q);null==ma?k.handleError({message:mxResources.get("errorUpdatingPreview")}):(ma.mathEnabled&&(la=ma.wnd.document,Ta&&(ma.wnd.IMMEDIATE_PRINT=!0),la.writeln('<script type="text/javascript" src="'+DRAWIO_BASE_URL+