Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(u){d.spinner.stop();null!=u?(u=new EmbedDialog(d,'<img src="'+(f.constructor!=DriveFile?u:"https://drive.google.com/uc?id="+f.getId())+'"/>'),d.showDialog(u.container,450,240,!0,!0),u.init()):d.handleError({message:mxResources.get("invalidPublicUrl")})})}));d.actions.put("embedImage",new Action(mxResources.get("image")+"...",function(){d.showEmbedImageDialog(function(f,u,D,E,M,k){d.spinner.spin(document.body,mxResources.get("loading"))&&d.createEmbedImage(f,u,D,E,M,k,function(x){d.spinner.stop();