Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(F.setAttribute("disabled","disabled"),C.setAttribute("disabled","disabled"));C.checked&&p.checked?q.getEditSelect().removeAttribute("disabled"):q.getEditSelect().setAttribute("disabled","disabled")});g=new CustomDialog(this,v,mxUtils.bind(this,function(){d(L.checked,G.checked,T.checked,p.checked,q.getLink(),F.checked)}),null,mxResources.get("embed"),u);this.showDialog(g.container,280,300,!0,!0)};EditorUi.prototype.createEmbedImage=function(d,g,n,t,u,v,B,H){function L(C){var J=" ",F="";t&&(J=" onclick=\"(function(img){if(img.wnd!=null&&!img.wnd.closed){img.wnd.focus();}else{var r=function(evt){if(evt.data=='ready'&&evt.source==img.wnd){img.wnd.postMessage(decodeURIComponent(img.getAttribute('src')),'*');window.removeEventListener('message',r);}};window.addEventListener('message',r);img.wnd=window.open('"+
EditorUi.lightboxHost+"/?client=1"+(null!=T?"&page="+T:"")+(u?"&edit=_blank":"")+(v?"&layers=1":"")+"');}})(this);\"",F+="cursor:pointer;");d&&(F+="max-width:100%;");var O="";n&&(O=' width="'+Math.round(G.width)+'" height="'+Math.round(G.height)+'"');B('<img src="'+C+'"'+O+(""!=F?' style="'+F+'"':"")+J+"/>")}var G=this.editor.graph.getGraphBounds(),T=this.getSelectedPageIndex();if(this.isExportToCanvas())this.editor.exportToCanvas(mxUtils.bind(this,function(C){var J=t?this.getFileData(!0):null;C=