Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxVsdxCanvas2D.prototype.convertSvg2Png=function(h,y,A){var B=this;this.filesLoading++;try{var m=document.createElement("canvas"),g=m.getContext("2d");y||(h=String.fromCharCode.apply(null,new Uint8Array(h)),h=window.btoa?btoa(h):Base64.encode(h,!0));y="data:image/svg+xml;base64,"+h;img=new Image;img.onload=function(){m.width=this.width;m.height=this.height;g.drawImage(this,0,0);try{A(m.toDataURL("image/png"))}catch(b){}B.filesLoading--;if(0==B.filesLoading)B.onFilesLoaded()};img.onerror=function(){console.log("SVG2PNG conversion failed");
try{A(h)}catch(b){}B.filesLoading--;if(0==B.filesLoading)B.onFilesLoaded()};img.src=y}catch(b){console.log("SVG2PNG conversion failed"+b.message);try{A(h)}catch(a){}this.filesLoading--;if(0==B.filesLoading)B.onFilesLoaded()}};