Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Editor.prototype.convertImages=function(l,B,N,Z){null==Z&&(Z=this.createImageUrlConverter());var U=0,aa=N||{};N=mxUtils.bind(this,function(Y,ka){Y=l.getElementsByTagName(Y);for(var qa=0;qa<Y.length;qa++)mxUtils.bind(this,function(ra){try{if(null!=ra){var pa=Z.convert(ra.getAttribute(ka));if(null!=pa&&"data:"!=pa.substring(0,5)){var wa=aa[pa];null==wa?(U++,this.convertImageToDataUri(pa,function(Ca){null!=Ca&&(aa[pa]=Ca,ra.setAttribute(ka,Ca));U--;0==U&&B(l)})):ra.setAttribute(ka,wa)}else null!=pa&&
ra.setAttribute(ka,pa)}}catch(Ca){}})(Y[qa])});N("image","xlink:href");N("img","src");0==U&&B(l)};Editor.base64Encode=function(l){for(var B="",N=0,Z=l.length,U,aa,Y;N<Z;){U=l.charCodeAt(N++)&255;if(N==Z){B+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(U>>2);B+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((U&3)<<4);B+="==";break}aa=l.charCodeAt(N++);if(N==Z){B+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(U>>2);