Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!0,!0,null,null,null,null,!0);z.focus();mxClient.IS_GC||mxClient.IS_FF||5<=document.documentMode?z.select():document.execCommand("selectAll",!1,null)};EditorUi.prototype.showEmbedImageDialog=function(c,e,g,q,p){var t=document.createElement("div");t.style.whiteSpace="nowrap";var x=this.editor.graph;if(null!=e){var B=document.createElement("h3");mxUtils.write(B,e);B.style.cssText="width:100%;text-align:center;margin-top:0px;margin-bottom:4px";t.appendChild(B)}var I=this.addCheckbox(t,mxResources.get("fit"),
!0),A=this.addCheckbox(t,mxResources.get("shadow"),x.shadowVisible&&q,!q),S=this.addCheckbox(t,g),l=this.addCheckbox(t,mxResources.get("lightbox"),!0),n=this.addEditButton(t,l),z=n.getEditInput(),C=1<x.model.getChildCount(x.model.getRoot()),D=this.addCheckbox(t,mxResources.get("layers"),C,!C);D.style.marginLeft=z.style.marginLeft;D.style.marginBottom="12px";D.style.marginTop="8px";mxEvent.addListener(l,"change",function(){l.checked?(C&&D.removeAttribute("disabled"),z.removeAttribute("disabled")):
(D.setAttribute("disabled","disabled"),z.setAttribute("disabled","disabled"));z.checked&&l.checked?n.getEditSelect().removeAttribute("disabled"):n.getEditSelect().setAttribute("disabled","disabled")});e=new CustomDialog(this,t,mxUtils.bind(this,function(){c(I.checked,A.checked,S.checked,l.checked,n.getLink(),D.checked)}),null,mxResources.get("embed"),p);this.showDialog(e.container,280,300,!0,!0)};EditorUi.prototype.createEmbedImage=function(c,e,g,q,p,t,x,B){function I(z){var C=" ",D="";q&&(C=" onclick=\"(function(img){if(img.wnd!=null&&!img.wnd.closed){img.wnd.focus();}else{var r=function(evt){if(evt.data=='ready'&&evt.source==img.wnd){img.wnd.postMessage(decodeURIComponent(img.getAttribute('src')),'*');window.removeEventListener('message',r);}};window.addEventListener('message',r);img.wnd=window.open('"+