Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(d,g,n,q,t,x,B,G){function I(Q){var P=" ",M="";q&&(P=" onclick=\"(function(img){if(img.wnd!=null&&!img.wnd.closed){img.wnd.focus();}else{var r=function(evt){if(evt.data=='ready'&&evt.source==img.wnd){img.wnd.postMessage(decodeURIComponent(img.getAttribute('src')),'*');window.removeEventListener('message',r);}};window.addEventListener('message',r);img.wnd=window.open('"+EditorUi.lightboxHost+"/?client=1"+(null!=U?"&page="+U:"")+(t?"&edit=_blank":"")+(x?"&layers=1":"")+"');}})(this);\"",M+=
"cursor:pointer;");d&&(M+="max-width:100%;");var p="";n&&(p=' width="'+Math.round(F.width)+'" height="'+Math.round(F.height)+'"');B('<img src="'+Q+'"'+p+(""!=M?' style="'+M+'"':"")+P+"/>")}var F=this.editor.graph.getGraphBounds(),U=this.getSelectedPageIndex();if(this.isExportToCanvas())this.editor.exportToCanvas(mxUtils.bind(this,function(Q){var P=q?this.getFileData(!0):null;Q=this.createImageDataUri(Q,P,"png");I(Q)}),null,null,null,mxUtils.bind(this,function(Q){G({message:mxResources.get("unknownError")})}),