Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxImageShape.prototype.getImageDataUri=function(){var b=this.image;if("data:image/svg+xml;base64,"==b.substring(0,26)&&null!=this.style&&"1"==mxUtils.getValue(this.style,"clipSvg","0")){if(null==this.clippedSvg||this.clippedImage!=b)this.clippedSvg=Graph.clipSvgDataUri(b,!0),this.clippedImage=b;b=this.clippedSvg}return b};(function(){var b=mxResources.get;mxResources.get=function(e,g,n){null==n&&(n=e);return b.apply(this,[e,g,n])}})();