Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.createImageDataUri(C,J,"png");L(C)}),null,null,null,mxUtils.bind(this,function(C){H({message:mxResources.get("unknownError")})}),null,!0,n?2:1,null,g,null,null,Editor.defaultBorder);else if(g=this.getFileData(!0),F.width*F.height<=MAX_AREA&&g.length<=MAX_REQUEST_SIZE){var p="";n&&(p="&w="+Math.round(2*F.width)+"&h="+Math.round(2*F.height));var q=new mxXmlRequest(EXPORT_URL,"format=png&base64=1&embedXml="+(t?"1":"0")+p+"&xml="+encodeURIComponent(g));q.send(mxUtils.bind(this,function(){200<=q.getStatus()&&