Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
fa=document.createElement("img");fa.setAttribute("src",ja);fa.setAttribute("alt",oa);fa.style.maxWidth=Qa+"px";fa.style.maxHeight=pa+"px";G=fa;var Xa=ja.replace(".drawio.xml","").replace(".drawio","").replace(".xml","");ra.appendChild(fa);fa.onerror=function(){this.src!=Xa?this.src=Xa:(this.src=Editor.errorImage,this.onerror=null)};mxEvent.addGestureListeners(ra,mxUtils.bind(this,function(Na){A(ra,null,null,aa,sa,ya)}),null,null);mxEvent.addListener(ra,"dblclick",function(Na){I();mxEvent.consume(Na)})}else if(!Ga&&