Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
C[O]&&(C[O]=(C[O]||0)+1,q++),J.push(P))}k.setCellStyles(mxConstants.STYLE_IMAGE,null,J);console.log("Removed",q,"image(s) from",J.length,"cell(s): ",[J,C])}finally{k.model.endUpdate()}}));c.actions.addAction("testInspect",mxUtils.bind(this,function(){console.log(c,k.getModel())}));c.actions.addAction("testXmlImageExport",mxUtils.bind(this,function(){var p=new mxImageExport,q=k.getGraphBounds(),C=k.view.scale,J=mxUtils.createXmlDocument(),G=J.createElement("output");J.appendChild(G);J=new mxXmlCanvas2D(G);