Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"data:"+c+";base64,"+I);u.style.position="absolute";u.style.top="70px";u.style.right="100px";u.style.maxWidth="120px";u.style.maxHeight="80px";mxUtils.setPrefixedStyle(u.style,"transform","translate(50%,-50%)");v.appendChild(u);mxClient.IS_FF||"image/png"!=c||null==navigator.clipboard||"function"!==typeof window.ClipboardItem||(g=mxUtils.button(mxResources.get("copy"),function(n){n=b.base64ToBlob(I,"image/png");n=new ClipboardItem({"image/png":n,"text/html":new Blob(['<img src="data:'+c+";base64,"+
I+'">'],{type:"text/html"})});navigator.clipboard.write([n]).then(mxUtils.bind(this,function(){b.alert(mxResources.get("copiedToClipboard"))}))["catch"](mxUtils.bind(this,function(z){b.handleError(z)}))}),g.style.marginTop="6px",g.className="geBtn");L&&Editor.popupsAllowed&&(u.style.cursor="pointer",mxEvent.addGestureListeners(u,null,null,function(n){mxEvent.isPopupTrigger(n)||t("_blank")}))}mxUtils.br(v);var A=document.createElement("div");A.style.textAlign="center";var S=0;A.style.marginTop="6px";