Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
new Image;S.onload=function(){try{var p=S.width,q=S.height;if(0==p&&0==q){var C=L.result,J=C.indexOf(","),G=decodeURIComponent(escape(atob(C.substring(J+1)))),P=mxUtils.parseXml(G).getElementsByTagName("svg");0<P.length&&(p=parseFloat(P[0].getAttribute("width")),q=parseFloat(P[0].getAttribute("height")))}n(L.result,p,q)}catch(O){t(O)}};S.src=L.result};L.onerror=function(F){t(F)}}else t(H)};A.onerror=function(H){t(H)};A.send()};EditorUi.prototype.insertAsPreText=function(d,g,n){var t=this.editor.graph,