Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ma.width=ja;ma.height=fa;var da=ma.toDataURL();ia!==da&&(f=ia,J=ja,O=fa)}}}catch(S){}k(f,J,O)};EditorUi.prototype.extractGraphModelFromPng=function(d){return Editor.extractGraphModelFromPng(d)};EditorUi.prototype.loadImage=function(d,f,k){try{var v=new Image;v.onload=function(){v.width=0<v.width?v.width:120;v.height=0<v.height?v.height:120;f(v)};null!=k&&(v.onerror=k);v.src=d}catch(z){if(null!=k)k(z);else throw z;}};EditorUi.prototype.getDefaultSketchMode=function(){var d="1"==urlParams.sketch;return"0"!=
(null!=urlParams.rough?urlParams.rough:d)};var y=EditorUi.prototype.createUi;EditorUi.prototype.createUi=function(){Editor.isSettingsEnabled()&&(this.doSetSketchMode(null!=mxSettings.settings.sketchMode&&null==urlParams.rough&&null==urlParams.sketch?mxSettings.settings.sketchMode:this.getDefaultSketchMode()),null!=mxSettings.settings.sidebarTitles&&(Sidebar.prototype.sidebarTitles=mxSettings.settings.sidebarTitles),this.formatWidth=mxSettings.getFormatWidth());y.apply(this,arguments)};var q=EditorUi.prototype.init;