Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
c.actions.addAction("testOptimize",mxUtils.bind(this,function(){k.model.beginUpdate();try{var l=k.model.cells,y=0,J=[],G=[],P;for(P in l){var p=l[P],z=k.getCurrentCellStyle(p)[mxConstants.STYLE_IMAGE];null!=z&&"data:"==z.substring(0,5)&&(null==J[z]&&(J[z]=(J[z]||0)+1,y++),G.push(p))}k.setCellStyles(mxConstants.STYLE_IMAGE,null,G);console.log("Removed",y,"image(s) from",G.length,"cell(s): ",[G,J])}finally{k.model.endUpdate()}}));c.actions.addAction("testInspect",mxUtils.bind(this,function(){console.log(c,