Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
":",m.data,function(C){null!=C&&d.spinner.spin(document.body,mxResources.get("inserting"))&&d.generatePlantUmlImage(C,m.format,function(M,ba,V){d.spinner.stop();f.getModel().beginUpdate();try{if("txt"==m.format)f.labelChanged(U,"<pre>"+M+"</pre>"),f.updateCellSize(U,!0);else{f.setCellStyles("image",d.convertDataUri(M),[U]);var Z=f.model.getGeometry(U);null!=Z&&(Z=Z.clone(),Z.width=ba,Z.height=V,f.cellsResized([U],[Z],!1))}f.setAttributeForCell(U,"plantUmlData",JSON.stringify({data:C,format:m.format}))}finally{f.getModel().endUpdate()}},
function(M){d.handleError(M)})},null,null,400,220);d.showDialog(Q.container,420,300,!0,!0);Q.init()};f.cellEditor.editMermaidData=function(U,Q,Y){var m=JSON.parse(Y);Q=new TextareaDialog(d,mxResources.get("mermaid")+":",m.data,function(C){null!=C&&d.spinner.spin(document.body,mxResources.get("inserting"))&&d.generateMermaidImage(C,m.config,function(M,ba,V){d.spinner.stop();f.getModel().beginUpdate();try{f.setCellStyles("image",M,[U]);var Z=f.model.getGeometry(U);null!=Z&&(Z=Z.clone(),Z.width=Math.max(Z.width,