Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.isResampleImageSize=function(c,e){e=null!=e?e:this.resampleThreshold;return c>e};EditorUi.prototype.resizeImage=function(c,e,g,q,p,t,x){p=null!=p?p:this.maxImageSize;var B=Math.max(1,c.width),I=Math.max(1,c.height);if(q&&this.isResampleImageSize(null!=x?x:e.length,t))try{var A=Math.max(B/p,I/p);if(1<A){var S=Math.round(B/A),l=Math.round(I/A),n=document.createElement("canvas");n.width=S;n.height=l;n.getContext("2d").drawImage(c,0,0,S,l);var z=n.toDataURL();if(z.length<e.length){var C=
document.createElement("canvas");C.width=S;C.height=l;var D=C.toDataURL();z!==D&&(e=z,B=S,I=l)}}}catch(M){}g(e,B,I)};EditorUi.prototype.extractGraphModelFromPng=function(c){return Editor.extractGraphModelFromPng(c)};EditorUi.prototype.loadImage=function(c,e,g){try{var q=new Image;q.onload=function(){q.width=0<q.width?q.width:120;q.height=0<q.height?q.height:120;e(q)};null!=g&&(q.onerror=g);q.src=c}catch(p){if(null!=g)g(p);else throw p;}};EditorUi.prototype.getDefaultSketchMode=function(){var c="1"==