Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.bind(this,function(K,O){K=null!=e.backgroundImage?e.backgroundImage.originalSrc:null;if(null!=K){var V=K.indexOf(",");if(0<V)for(K=K.substring(V+1),O=O.getProperty("patches"),V=0;V<O.length;V++)if(null!=O[V][EditorUi.DIFF_UPDATE]&&null!=O[V][EditorUi.DIFF_UPDATE][K]||null!=O[V][EditorUi.DIFF_REMOVE]&&0<=mxUtils.indexOf(O[V][EditorUi.DIFF_REMOVE],K)){e.refreshBackgroundImage();break}}}));var t=e.getBackgroundImageObject;e.getBackgroundImageObject=function(K,O){var V=t.apply(this,arguments);
if(null!=V&&null!=V.originalSrc)if(!O)V={src:V.originalSrc};else if(O&&null!=this.themes&&"darkTheme"==this.defaultThemeName){var k=this.stylesheet,y=this.shapeForegroundColor,G=this.shapeBackgroundColor;this.stylesheet=this.getDefaultStylesheet();this.shapeBackgroundColor="#ffffff";this.shapeForegroundColor="#000000";V=c.createImageForPageLink(V.originalSrc);this.shapeBackgroundColor=G;this.shapeForegroundColor=y;this.stylesheet=k}return V};this.isOffline()||"undefined"===typeof window.EditDataDialog||