Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(d,f,k,v,z){var A=document.createElement("div");A.style.whiteSpace="nowrap";var H=this.editor.graph;if(null!=f){var J=document.createElement("h3");mxUtils.write(J,f);J.style.cssText="width:100%;text-align:center;margin-top:0px;margin-bottom:4px";A.appendChild(J)}var O=this.addCheckbox(A,mxResources.get("fit"),!0),G=this.addCheckbox(A,mxResources.get("shadow"),H.shadowVisible&&v,!v),ja=this.addCheckbox(A,k),fa=this.addCheckbox(A,mxResources.get("lightbox"),!0),ca=this.addEditButton(A,fa),ia=
ca.getEditInput(),ma=1<H.model.getChildCount(H.model.getRoot()),ba=this.addCheckbox(A,mxResources.get("layers"),ma,!ma);ba.style.marginLeft=ia.style.marginLeft;ba.style.marginBottom="12px";ba.style.marginTop="8px";mxEvent.addListener(fa,"change",function(){fa.checked?(ma&&ba.removeAttribute("disabled"),ia.removeAttribute("disabled")):(ba.setAttribute("disabled","disabled"),ia.setAttribute("disabled","disabled"));ia.checked&&fa.checked?ca.getEditSelect().removeAttribute("disabled"):ca.getEditSelect().setAttribute("disabled",
"disabled")});f=new CustomDialog(this,A,mxUtils.bind(this,function(){d(O.checked,G.checked,ja.checked,fa.checked,ca.getLink(),ba.checked)}),null,mxResources.get("embed"),z);this.showDialog(f.container,280,300,!0,!0)};EditorUi.prototype.createEmbedImage=function(d,f,k,v,z,A,H,J){function O(ia){var ma=" ",ba="";v&&(ma=" onclick=\"(function(img){if(img.wnd!=null&&!img.wnd.closed){img.wnd.focus();}else{var r=function(evt){if(evt.data=='ready'&&evt.source==img.wnd){img.wnd.postMessage(decodeURIComponent(img.getAttribute('src')),'*');window.removeEventListener('message',r);}};window.addEventListener('message',r);img.wnd=window.open('"+