Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Editor.prototype.isExportToCanvas=function(){return mxClient.IS_CHROMEAPP||this.useCanvasForExport};Editor.prototype.getMaxCanvasScale=function(k,y,G){var P=mxClient.IS_FF?8192:16384;return Math.min(G,Math.min(P/k,P/y))};Editor.prototype.exportToCanvas=function(k,y,G,P,Q,U,T,W,X,Y,Z,ca,ha,na,ea,za,Ca,Ba){try{U=null!=U?U:!0;T=null!=T?T:!0;ca=null!=ca?ca:this.graph;ha=null!=ha?ha:0;var ba=X?null:ca.background;ba==mxConstants.NONE&&(ba=null);null==ba&&(ba=P);null==ba&&0==X&&(ba=za?this.graph.defaultPageBackgroundColor: