Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ha));Q--;0==Q&&y(k)})):Y.setAttribute(W,ca)}else null!=Z&&Y.setAttribute(W,Z)}}catch(ha){}})(T[X])});G("image","xlink:href");G("img","src");0==Q&&y(k)};Editor.base64Encode=function(k){for(var y="",G=0,P=k.length,Q,U,T;G<P;){Q=k.charCodeAt(G++)&255;if(G==P){y+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(Q>>2);y+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((Q&3)<<4);y+="==";break}U=k.charCodeAt(G++);if(G==P){y+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(Q>>
2);y+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((Q&3)<<4|(U&240)>>4);y+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((U&15)<<2);y+="=";break}T=k.charCodeAt(G++);y+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(Q>>2);y+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((Q&3)<<4|(U&240)>>4);y+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((U&15)<<2|(T&192)>>6);
y+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(T&63)}return y};Editor.prototype.loadUrl=function(k,y,G,P,Q,U,T,W){try{var X=!T&&(P||/(\.png)($|\?)/i.test(k)||/(\.jpe?g)($|\?)/i.test(k)||/(\.gif)($|\?)/i.test(k)||/(\.pdf)($|\?)/i.test(k));Q=null!=Q?Q:!0;var Y=mxUtils.bind(this,function(){mxUtils.get(k,mxUtils.bind(this,function(Z){if(200<=Z.getStatus()&&299>=Z.getStatus()){if(null!=y){var ca=Z.getText();if(X){if((9==document.documentMode||10==document.documentMode)&&"undefined"!==