Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
[];for(var y=0;256>y;y++)for(var q=y,E=0;8>E;E++)q=1==(q&1)?3988292384^q>>>1:q>>>1,Editor.crcTable[y]=q;Editor.updateCRC=function(l,B,N,Z){for(var U=0;U<Z;U++)l=Editor.crcTable[(l^B.charCodeAt(N+U))&255]^l>>>8;return l};Editor.crc32=function(l){for(var B=-1,N=0;N<l.length;N++)B=B>>>8^Editor.crcTable[(B^l.charCodeAt(N))&255];return(B^-1)>>>0};Editor.writeGraphModelToPng=function(l,B,N,Z,U){function aa(pa,wa){var Ca=qa;qa+=wa;return pa.substring(Ca,qa)}function Y(pa){pa=aa(pa,4);return pa.charCodeAt(3)+
(pa.charCodeAt(2)<<8)+(pa.charCodeAt(1)<<16)+(pa.charCodeAt(0)<<24)}function ka(pa){return String.fromCharCode(pa>>24&255,pa>>16&255,pa>>8&255,pa&255)}l=l.substring(l.indexOf(",")+1);l=window.atob?atob(l):Base64.decode(l,!0);var qa=0;if(aa(l,8)!=String.fromCharCode(137)+"PNG"+String.fromCharCode(13,10,26,10))null!=U&&U();else if(aa(l,4),"IHDR"!=aa(l,4))null!=U&&U();else{aa(l,17);U=l.substring(0,qa);do{var ra=Y(l);if("IDAT"==aa(l,4)){U=l.substring(0,qa-8);"pHYs"==B&&"dpi"==N?(N=Math.round(Z/.0254),
N=ka(N)+ka(N)+String.fromCharCode(1)):N=N+String.fromCharCode(0)+("zTXt"==B?String.fromCharCode(0):"")+Z;Z=4294967295;Z=Editor.updateCRC(Z,B,0,4);Z=Editor.updateCRC(Z,N,0,N.length);U+=ka(N.length)+B+N+ka(Z^4294967295);U+=l.substring(qa-8,l.length);break}U+=l.substring(qa-8,qa-4+ra);aa(l,ra);aa(l,4)}while(ra);return"data:image/png;base64,"+(window.btoa?btoa(U):Base64.encode(U,!0))}};if(window.ColorDialog){FilenameDialog.filenameHelpLink="https://www.drawio.com/doc/faq/save-file-formats";var M=ColorDialog.addRecentColor;