Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.editor.chromeless&&!this.editor.editable||!(mxSettings.settings.isNew||8>=parseInt(mxSettings.settings.version||0))||(this.toggleScratchpad(),mxSettings.save())));this.addListener("formatWidthChanged",function(){mxSettings.setFormatWidth(this.formatWidth);mxSettings.save()})}};EditorUi.prototype.copyImage=function(d,g,n){try{null!=navigator.clipboard&&"function"===typeof window.ClipboardItem&&this.spinner.spin(document.body,mxResources.get("exporting"))&&this.editor.exportToCanvas(mxUtils.bind(this,
function(t,u){try{this.spinner.stop();var v=this.createImageDataUri(t,g,"png"),A=parseInt(u.getAttribute("width")),H=parseInt(u.getAttribute("height"));this.writeImageToClipboard(v,A,H,mxUtils.bind(this,function(L){this.handleError(L)}))}catch(L){this.handleError(L)}}),null,null,null,mxUtils.bind(this,function(t){this.spinner.stop();this.handleError(t)}),null,null,null!=n?n:4,null==this.editor.graph.background||this.editor.graph.background==mxConstants.NONE,null,null,null,10,null,null,!1,null,0<d.length?
d:null)}catch(t){this.handleError(t)}};EditorUi.prototype.writeImageToClipboard=function(d,g,n,t){var u=this.base64ToBlob(d.substring(d.indexOf(",")+1),"image/png");d=new ClipboardItem({"image/png":u,"text/html":new Blob(['<img src="'+d+'" width="'+g+'" height="'+n+'">'],{type:"text/html"})});navigator.clipboard.write([d])["catch"](t)};EditorUi.prototype.copyCells=function(d,g){var n=this.editor.graph;if(n.isSelectionEmpty())d.innerText="";else{var t=mxUtils.sortCells(n.model.getTopmostCells(n.getSelectionCells())),