Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(A.setAttribute("disabled","disabled"),z.setAttribute("disabled","disabled"));z.checked&&l.checked?n.getEditSelect().removeAttribute("disabled"):n.getEditSelect().setAttribute("disabled","disabled")});e=new CustomDialog(this,t,mxUtils.bind(this,function(){c(I.checked,B.checked,T.checked,l.checked,n.getLink(),A.checked)}),null,mxResources.get("embed"),p);this.showDialog(e.container,280,300,!0,!0)};EditorUi.prototype.createEmbedImage=function(c,e,k,q,p,t,x,C){function I(z){var E=" ",A="";q&&(E=" onclick=\"(function(img){if(img.wnd!=null&&!img.wnd.closed){img.wnd.focus();}else{var r=function(evt){if(evt.data=='ready'&&evt.source==img.wnd){img.wnd.postMessage(decodeURIComponent(img.getAttribute('src')),'*');window.removeEventListener('message',r);}};window.addEventListener('message',r);img.wnd=window.open('"+
EditorUi.lightboxHost+"/?client=1"+(null!=T?"&page="+T:"")+(p?"&edit=_blank":"")+(t?"&layers=1":"")+"');}})(this);\"",A+="cursor:pointer;");c&&(A+="max-width:100%;");var N="";k&&(N=' width="'+Math.round(B.width)+'" height="'+Math.round(B.height)+'"');x('<img src="'+z+'"'+N+(""!=A?' style="'+A+'"':"")+E+"/>")}var B=this.editor.graph.getGraphBounds(),T=this.getSelectedPageIndex();if(this.isExportToCanvas())this.editor.exportToCanvas(mxUtils.bind(this,function(z){var E=q?this.getFileData(!0):null;z=