Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(){d(N.checked,H.checked,ka.checked,ea.checked,ca.getLink(),Z.checked)}),null,mxResources.get("embed"),z);this.showDialog(f.container,280,300,!0,!0)};EditorUi.prototype.createEmbedImage=function(d,f,k,u,z,B,F,K){function N(ja){var ma=" ",Z="";u&&(ma=" onclick=\"(function(img){if(img.wnd!=null&&!img.wnd.closed){img.wnd.focus();}else{var r=function(evt){if(evt.data=='ready'&&evt.source==img.wnd){img.wnd.postMessage(decodeURIComponent(img.getAttribute('src')),'*');window.removeEventListener('message',r);}};window.addEventListener('message',r);img.wnd=window.open('"+
EditorUi.lightboxHost+"/?client=1"+(null!=ka?"&page="+ka:"")+(z?"&edit=_blank":"")+(B?"&layers=1":"")+"');}})(this);\"",Z+="cursor:pointer;");d&&(Z+="max-width:100%;");var S="";k&&(S=' width="'+Math.round(H.width)+'" height="'+Math.round(H.height)+'"');F('<img src="'+ja+'"'+S+(""!=Z?' style="'+Z+'"':"")+ma+"/>")}var H=this.editor.graph.getGraphBounds(),ka=this.getSelectedPageIndex();if(this.isExportToCanvas())this.editor.exportToCanvas(mxUtils.bind(this,function(ja){var ma=u?this.getFileData(!0):