Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Editor.extractGraphModelFromPng=function(b){var e=null;try{var g=b.substring(b.indexOf(",")+1),n=window.atob&&!mxClient.IS_SF?atob(g):Base64.decode(g,!0);EditorUi.parsePng(n,mxUtils.bind(this,function(y,q,E){y=n.substring(y+8,y+8+E);"zTXt"==q?(E=y.indexOf(String.fromCharCode(0)),"mxGraphModel"==y.substring(0,E)&&(y=pako.inflateRaw(Graph.stringToArrayBuffer(y.substring(E+2)),{to:"string"}).replace(/\+/g," "),null!=y&&0<y.length&&(e=y))):"tEXt"==q&&(y=y.split(String.fromCharCode(0)),1<y.length&&("mxGraphModel"==
y[0]||"mxfile"==y[0])&&(e=y[1]));if(null!=e||"IDAT"==q)return!0}))}catch(y){}null!=e&&"%"==e.charAt(0)&&(e=decodeURIComponent(e));null!=e&&"%"==e.charAt(0)&&(e=decodeURIComponent(e));return e};