Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null,null!=z?z.value:null,X.value,"embedFonts"==ba.value,"lblToSvg"==ba.value)}),null,l,u);this.showDialog(l.container,340,da,!0,!0,null,null,null,null,!0);ia.focus();mxClient.IS_GC||mxClient.IS_FF||5<=document.documentMode?ia.select():document.execCommand("selectAll",!1,null)};EditorUi.prototype.showEmbedImageDialog=function(d,f,l,u,A){var B=document.createElement("div");B.style.whiteSpace="nowrap";var F=this.editor.graph;if(null!=f){var M=document.createElement("h3");mxUtils.write(M,f);M.style.cssText=
"width:100%;text-align:center;margin-top:0px;margin-bottom:4px";B.appendChild(M)}var O=this.addCheckbox(B,mxResources.get("fit"),!0),H=this.addCheckbox(B,mxResources.get("shadow"),F.shadowVisible&&u,!u),ja=this.addCheckbox(B,l),da=this.addCheckbox(B,mxResources.get("lightbox"),!0),ca=this.addEditButton(B,da),ia=ca.getEditInput(),ma=1<F.model.getChildCount(F.model.getRoot()),aa=this.addCheckbox(B,mxResources.get("layers"),ma,!ma);aa.style.marginLeft=ia.style.marginLeft;aa.style.marginBottom="12px";
aa.style.marginTop="8px";mxEvent.addListener(da,"change",function(){da.checked?(ma&&aa.removeAttribute("disabled"),ia.removeAttribute("disabled")):(aa.setAttribute("disabled","disabled"),ia.setAttribute("disabled","disabled"));ia.checked&&da.checked?ca.getEditSelect().removeAttribute("disabled"):ca.getEditSelect().setAttribute("disabled","disabled")});f=new CustomDialog(this,B,mxUtils.bind(this,function(){d(O.checked,H.checked,ja.checked,da.checked,ca.getLink(),aa.checked)}),null,mxResources.get("embed"),
A);this.showDialog(f.container,280,300,!0,!0)};EditorUi.prototype.createEmbedImage=function(d,f,l,u,A,B,F,M){function O(ia){var ma=" ",aa="";u&&(ma=" onclick=\"(function(img){if(img.wnd!=null&&!img.wnd.closed){img.wnd.focus();}else{var r=function(evt){if(evt.data=='ready'&&evt.source==img.wnd){img.wnd.postMessage(decodeURIComponent(img.getAttribute('src')),'*');window.removeEventListener('message',r);}};window.addEventListener('message',r);img.wnd=window.open('"+EditorUi.lightboxHost+"/?client=1"+