Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
new Image;S.onload=function(){try{var l=S.width,n=S.height;if(0==l&&0==n){var z=I.result,C=z.indexOf(","),D=decodeURIComponent(escape(atob(z.substring(C+1)))),M=mxUtils.parseXml(D).getElementsByTagName("svg");0<M.length&&(l=parseFloat(M[0].getAttribute("width")),n=parseFloat(M[0].getAttribute("height")))}g(I.result,l,n)}catch(K){q(K)}};S.src=I.result};I.onerror=function(A){q(A)}}else q(B)};x.onerror=function(B){q(B)};x.send()};EditorUi.prototype.insertAsPreText=function(c,e,g){var q=this.editor.graph,