Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
da));U--;0==U&&B(m)})):Y.setAttribute(V,ca)}else null!=Z&&Y.setAttribute(V,Z)}}catch(da){}})(Q[X])});K("image","xlink:href");K("img","src");0==U&&B(m)};Editor.base64Encode=function(m){for(var B="",K=0,R=m.length,U,W,Q;K<R;){U=m.charCodeAt(K++)&255;if(K==R){B+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(U>>2);B+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((U&3)<<4);B+="==";break}W=m.charCodeAt(K++);if(K==R){B+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(U>>
2);B+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((U&3)<<4|(W&240)>>4);B+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((W&15)<<2);B+="=";break}Q=m.charCodeAt(K++);B+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(U>>2);B+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((U&3)<<4|(W&240)>>4);B+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((W&15)<<2|(Q&192)>>6);
B+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(Q&63)}return B};Editor.prototype.loadUrl=function(m,B,K,R,U,W,Q,V){try{var X=!Q&&(R||/(\.png)($|\?)/i.test(m)||/(\.jpe?g)($|\?)/i.test(m)||/(\.gif)($|\?)/i.test(m)||/(\.pdf)($|\?)/i.test(m));U=null!=U?U:!0;var Y=mxUtils.bind(this,function(){mxUtils.get(m,mxUtils.bind(this,function(Z){if(200<=Z.getStatus()&&299>=Z.getStatus()){if(null!=B){var ca=Z.getText();if(X){if((9==document.documentMode||10==document.documentMode)&&"undefined"!==