Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Fa;Ua<cb;Ua+=P)Ca.drawImage(sa,va/ka,Ua/ka);Va()}catch(ab){null!=V&&V(ab)}};sa.onerror=function(va){null!=V&&V(va)};sa.src=L}else Va()}catch(va){null!=V&&V(va)}});Ea.onerror=function(Va){null!=V&&V(Va)};ra&&this.graph.addSvgShadow(Aa);this.graph.mathEnabled&&this.addMathCss(Aa);var za=mxUtils.bind(this,function(){try{null!=this.resolvedFontCss&&this.addFontCss(Aa,this.resolvedFontCss),Ea.src=Editor.createSvgDataUri(mxUtils.getXml(Aa))}catch(Va){null!=V&&V(Va)}});this.embedExtFonts(mxUtils.bind(this,