Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"").replace(/ (NS xml|\S*):space="preserve"/g,' xml:space="preserve"');var B=mxUtils.parseXml(I).getElementsByTagName("svg");if(0<B.length&&"error"!=B[0].getAttribute("aria-roledescription")){var T=parseFloat(B[0].getAttribute("width")),l=parseFloat(B[0].getAttribute("height"));if(isNaN(T)||isNaN(l))try{var n=B[0].getAttribute("viewBox").split(/\s+/);T=parseFloat(n[2]);l=parseFloat(n[3])}catch(z){T=T||100,l=l||100}k(this.convertDataUri(Editor.createSvgDataUri(I)),T,l)}else null!=p?p():q({message:mxResources.get("invalidInput")})}catch(z){q(z)}});