Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"").replace(/ (NS xml|\S*):space="preserve"/g,' xml:space="preserve"');var A=mxUtils.parseXml(I).getElementsByTagName("svg");if(0<A.length&&"error"!=A[0].getAttribute("aria-roledescription")){var S=parseFloat(A[0].getAttribute("width")),l=parseFloat(A[0].getAttribute("height"));if(isNaN(S)||isNaN(l))try{var n=A[0].getAttribute("viewBox").split(/\s+/);S=parseFloat(n[2]);l=parseFloat(n[3])}catch(z){S=S||100,l=l||100}g(this.convertDataUri(Editor.createSvgDataUri(I)),S,l)}else null!=p?p():q({message:mxResources.get("invalidInput")})}catch(z){q(z)}});