Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
0,Ka,cb),Ca.fillStyle=ta,Ca.fill());1!=ka&&Ca.scale(ka,ka);if(ya){var Ma=wa.view,x=Ma.scale;Ma.scale=1;var L=btoa(unescape(encodeURIComponent(Ma.createSvgGrid(Ma.gridColor))));Ma.scale=x;L="data:image/svg+xml;base64,"+L;var P=wa.gridSize*Ma.gridSteps*ka,X=wa.getGraphBounds(),ea=Ma.translate.x*x,la=Ma.translate.y*x,oa=ea+(X.x-ea)/x-Da,xa=la+(X.y-la)/x-Da,sa=new Image;sa.onload=function(){try{for(var va=-Math.round(P-mxUtils.mod((ea-oa)*ka,P)),Fa=-Math.round(P-mxUtils.mod((la-xa)*ka,P));va<Ka;va+=P)for(var Ua=
Fa;Ua<cb;Ua+=P)Ca.drawImage(sa,va/ka,Ua/ka);Va()}catch(ab){null!=V&&V(ab)}};sa.onerror=function(va){null!=V&&V(va)};sa.src=L}else Va()}catch(va){null!=V&&V(va)}});Ea.onerror=function(Va){null!=V&&V(Va)};ra&&this.graph.addSvgShadow(Aa);this.graph.mathEnabled&&this.addMathCss(Aa);var za=mxUtils.bind(this,function(){try{null!=this.resolvedFontCss&&this.addFontCss(Aa,this.resolvedFontCss),Ea.src=Editor.createSvgDataUri(mxUtils.getXml(Aa))}catch(Va){null!=V&&V(Va)}});this.embedExtFonts(mxUtils.bind(this,