Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
'<img src="'+(p.constructor!=DriveFile?q:"https://drive.google.com/uc?id="+p.getId())+'"/>'),c.showDialog(q.container,450,240,!0,!0),q.init()):c.handleError({message:mxResources.get("invalidPublicUrl")})})}));c.actions.put("embedImage",new Action(mxResources.get("image")+"...",function(){c.showEmbedImageDialog(function(p,q,C,J,F,O){c.spinner.spin(document.body,mxResources.get("loading"))&&c.createEmbedImage(p,q,C,J,F,O,function(S){c.spinner.stop();S=new EmbedDialog(c,S);c.showDialog(S.container,450,