Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
z=v.data;if(null!=z){z=this.convertDataUri(z);var A="shape=image;verticalLabelPosition=bottom;verticalAlign=top;imageAspect=0;";"fixed"==v.aspect&&(A+="aspect=fixed;");f.appendChild(this.sidebar.createVertexTemplate(A+"image="+z,v.w,v.h,"",v.title||"",!1,null,!0))}else null!=v.xml&&(z=this.stringToCells("<"==v.xml.charAt(0)?v.xml:Graph.decompress(v.xml)),0<z.length&&f.appendChild(this.sidebar.createVertexTemplateFromCells(z,v.w,v.h,v.title||"",!0,null,!0)))}};EditorUi.prototype.getResource=function(d){return null!=
d?d[mxLanguage]||d.main:null};EditorUi.prototype.footerHeight=0;"1"==urlParams.savesidebar&&(Sidebar.prototype.thumbWidth=64,Sidebar.prototype.thumbHeight=64);EditorUi.initTheme=function(){"atlas"==Editor.currentTheme&&(mxClient.link("stylesheet",STYLE_PATH+"/atlas.css"),"undefined"!==typeof Toolbar&&(Toolbar.prototype.unselectedBackground="linear-gradient(rgb(255, 255, 255) 0px, rgb(242, 242, 242) 100%)",Toolbar.prototype.selectedBackground="rgb(242, 242, 242)"),Editor.prototype.initialTopSpacing=