Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!0,!0,null,null,null,null,!0);z.focus();mxClient.IS_GC||mxClient.IS_FF||5<=document.documentMode?z.select():document.execCommand("selectAll",!1,null)};EditorUi.prototype.showEmbedImageDialog=function(c,e,k,q,p){var t=document.createElement("div");t.style.whiteSpace="nowrap";var x=this.editor.graph;if(null!=e){var C=document.createElement("h3");mxUtils.write(C,e);C.style.cssText="width:100%;text-align:center;margin-top:0px;margin-bottom:4px";t.appendChild(C)}var I=this.addCheckbox(t,mxResources.get("fit"),
!0),B=this.addCheckbox(t,mxResources.get("shadow"),x.shadowVisible&&q,!q),T=this.addCheckbox(t,k),l=this.addCheckbox(t,mxResources.get("lightbox"),!0),n=this.addEditButton(t,l),z=n.getEditInput(),E=1<x.model.getChildCount(x.model.getRoot()),A=this.addCheckbox(t,mxResources.get("layers"),E,!E);A.style.marginLeft=z.style.marginLeft;A.style.marginBottom="12px";A.style.marginTop="8px";mxEvent.addListener(l,"change",function(){l.checked?(E&&A.removeAttribute("disabled"),z.removeAttribute("disabled")):
(A.setAttribute("disabled","disabled"),z.setAttribute("disabled","disabled"));z.checked&&l.checked?n.getEditSelect().removeAttribute("disabled"):n.getEditSelect().setAttribute("disabled","disabled")});e=new CustomDialog(this,t,mxUtils.bind(this,function(){c(I.checked,B.checked,T.checked,l.checked,n.getLink(),A.checked)}),null,mxResources.get("embed"),p);this.showDialog(e.container,280,300,!0,!0)};EditorUi.prototype.createEmbedImage=function(c,e,k,q,p,t,x,C){function I(z){var E=" ",A="";q&&(E=" onclick=\"(function(img){if(img.wnd!=null&&!img.wnd.closed){img.wnd.focus();}else{var r=function(evt){if(evt.data=='ready'&&evt.source==img.wnd){img.wnd.postMessage(decodeURIComponent(img.getAttribute('src')),'*');window.removeEventListener('message',r);}};window.addEventListener('message',r);img.wnd=window.open('"+