u.x,u.y),b.editor.graph.fireEvent(new mxEventObject("cellsInserted","cells",N))}finally{b.editor.graph.getModel().endUpdate()}b.editor.graph.setSelectionCells(N);b.editor.graph.scrollCellToVisible(b.editor.graph.getSelectionCell());t.destroy();n.parentNode.removeChild(n)}}}function q(){return"list"==D.value?"Person\n-name: String\n-birthDate: Date\n--\n+getName(): String\n+setName(String): void\n+isBirthday(): boolean\n\nAddress\n-street: String\n-city: String\n-state: String":"mermaid"==D.value||
"mermaid2drawio"==D.value?"graph TD;\n  A--\x3eB;\n  A--\x3eC;\n  B--\x3eD;\n  C--\x3eD;":"table"==D.value?"CREATE TABLE Suppliers\n(\nsupplier_id int NOT NULL PRIMARY KEY,\nsupplier_name char(50) NOT NULL,\ncontact_name char(50),\n);\nCREATE TABLE Customers\n(\ncustomer_id int NOT NULL PRIMARY KEY,\ncustomer_name char(50) NOT NULL,\naddress char(50),\ncity char(50),\nstate char(25),\nzip_code char(10)\n);\n":"plantUmlPng"==D.value?"@startuml\nskinparam backgroundcolor transparent\nskinparam shadowing false\nAlice -> Bob: Authentication Request\nBob --\x3e Alice: Authentication Response\n\nAlice -> Bob: Another authentication Request\nAlice <-- Bob: Another authentication Response\n@enduml":
"plantUmlSvg"==D.value||"plantUmlTxt"==D.value?"@startuml\nskinparam shadowing false\nAlice -> Bob: Authentication Request\nBob --\x3e Alice: Authentication Response\n\nAlice -> Bob: Another authentication Request\nAlice <-- Bob: Another authentication Response\n@enduml":";Example:\na->b\nb->edge label->c\nc->a\n"}var u=b.editor.graph.getFreeInsertPoint();f=document.createElement("div");f.style.textAlign="right";var z=document.createElement("textarea");z.style.boxSizing="border-box";z.style.resize=


Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.


`+i,p.parser);const m=Oe().securityLevel;let b;m==="sandbox"&&(b=Mr("#i"+a));const C=Mr(m==="sandbox"?b.nodes()[0].contentDocument.body:"body").select("#"+a);C.append("g");const D=p.db.getMindmap(),N=C.append("g");N.attr("class","mindmap-edges");const B=C.append("g");B.attr("class","mindmap-nodes"),vjt(B,D,-1,v);const j=await pUe(D,v);gUe(N,j),bUe(j),J9(void 0,C,v.mindmap.padding,v.mindmap.useMaxWidth),Editor.mermaidToDrawio(j,"Mindmap")}},wUe=i=>{let a="";for(let f=0;f<i.THEME_COLOR_LIMIT;f++)i["lineColor"+f]=i["lineColor"+f]||i["cScaleInv"+f],Q9(i["lineColor"+f])?i["lineColor"+f]=Ds(i["lineColor"+f],20):i["lineColor"+f]=ta(i["lineColor"+f],20);for(let f=0;f<i.THEME_COLOR_LIMIT;f++){const p=""+(17-3*f);a+=`
    .section-${f-1} rect, .section-${f-1} path, .section-${f-1} circle, .section-${f-1} polygon, .section-${f-1} path  {
      fill: ${i["cScale"+f]};
    }
    .section-${f-1} text {
     fill: ${i["cScaleLabel"+f]};
    }
    .node-icon-${f-1} {
      font-size: 40px;
      color: ${i["cScaleLabel"+f]};
    }
    .section-edge-${f-1}{
      stroke: ${i["cScale"+f]};
    }
    .edge-depth-${f-1}{
      stroke-width: ${p};
    }
    .section-${f-1} line {
      stroke: ${i["cScaleInv"+f]} ;
      stroke-width: 3;
    }

    .disabled, .disabled circle, .disabled text {
      fill: lightgray;
    }
    .disabled text {
      fill: #efefef;
    }
    `}return a},mUe=Object.freeze(Object.defineProperty({__proto__:null,diagram:{db:tUe,renderer:vUe,parser:VGe,styles:i=>`


`;let w3=Oe(),D5;const TN=450,Ize=Object.freeze(Object.defineProperty({__proto__:null,diagram:{parser:Lze,db:Mze,renderer:{draw:(i,a,f,p)=>{var pt;try{w3=Oe(),zt.debug(`Rendering info diagram


function X(){mxShape.call(this)}function U(){mxShape.call(this)}function Z(){mxRectangleShape.call(this)}function ba(){mxShape.call(this)}function ia(){mxShape.call(this)}function qa(){mxShape.call(this)}function ra(){mxShape.call(this)}function pa(){mxShape.call(this)}function xa(){mxCylinder.call(this)}function Ca(){mxCylinder.call(this)}function Aa(){mxRectangleShape.call(this)}function za(){mxDoubleEllipse.call(this)}function Ma(){mxDoubleEllipse.call(this)}function Qa(){mxArrowConnector.call(this);


function(c,m,v){c=[];var n=Math.min(m,v/2),t=Math.min(m-n,Math.max(0,parseFloat(mxUtils.getValue(this.style,"size",this.size)))*m);c.push(new mxConnectionConstraint(new mxPoint(0,.5),!1,null));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,t,0));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(t+m-n),0));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m-n,0));c.push(new mxConnectionConstraint(new mxPoint(1,.5),!1,null));c.push(new mxConnectionConstraint(new mxPoint(0,
0),!1,null,m-n,v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(t+m-n),v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,t,v));return c};xa.prototype.getConstraints=function(c,m,v){m=parseFloat(mxUtils.getValue(c,"jettyWidth",xa.prototype.jettyWidth))/2;c=parseFloat(mxUtils.getValue(c,"jettyHeight",xa.prototype.jettyHeight));var n=[new mxConnectionConstraint(new mxPoint(0,0),!1,null,m),new mxConnectionConstraint(new mxPoint(.25,0),!0),new mxConnectionConstraint(new mxPoint(.5,


0),!1,null,.5*(m-n),v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m-n),.5*(v+t)));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m-n),t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.25*m-.25*n,t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,.5*t));return c};Ba.prototype.getConstraints=function(c,m,v){c=[];var n=Math.max(0,Math.min(m,parseFloat(mxUtils.getValue(this.style,
"dx",this.dx)))),t=Math.max(0,Math.min(v,parseFloat(mxUtils.getValue(this.style,"dy",this.dy))));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1));c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));c.push(new mxConnectionConstraint(new mxPoint(1,0),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,.5*t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m+n),t));c.push(new mxConnectionConstraint(new mxPoint(0,
0),!1,null,n,t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,n,.5*(v+t)));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,n,v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*n,v));c.push(new mxConnectionConstraint(new mxPoint(0,.5),!1));c.push(new mxConnectionConstraint(new mxPoint(0,1),!1));return c};ya.prototype.constraints=[new mxConnectionConstraint(new mxPoint(0,0),!1),new mxConnectionConstraint(new mxPoint(0,.5),!1),new mxConnectionConstraint(new mxPoint(0,


Uint8Array.from||(Uint8Array.from=function(){var b=Object.prototype.toString,e=function(p){return"function"===typeof p||"[object Function]"===b.call(p)},g=Math.pow(2,53)-1;return function(p){var y=Object(p);if(null==p)throw new TypeError("Array.from requires an array-like object - not null or undefined");var q=1<arguments.length?arguments[1]:void 0,E;if("undefined"!==typeof q){if(!e(q))throw new TypeError("Array.from: when provided, the second argument must be a function");2<arguments.length&&(E=
arguments[2])}var L=Number(y.length);L=isNaN(L)?0:0!==L&&isFinite(L)?(0<L?1:-1)*Math.floor(Math.abs(L)):L;L=Math.min(Math.max(L,0),g);for(var T=e(this)?Object(new this(L)):Array(L),G=0,M;G<L;)M=y[G],T[G]=q?"undefined"===typeof E?q(M,G):q.call(E,M,G):M,G+=1;T.length=L;return T}}());mxConstants.POINTS=1;mxConstants.MILLIMETERS=2;mxConstants.INCHES=3;mxConstants.METERS=4;mxConstants.PIXELS_PER_MM=3.937;mxConstants.PIXELS_PER_INCH=100;mxConstants.SHADOW_OPACITY=.25;mxConstants.SHADOWCOLOR="#000000";


function(d,f,k,u,z,C,F,K){EditorUi.logEvent("SHOULD NOT BE CALLED: loadUrl");return this.editor.loadUrl(d,f,k,u,z,C,F,K)};EditorUi.prototype.loadFonts=function(d){EditorUi.logEvent("SHOULD NOT BE CALLED: loadFonts");return this.editor.loadFonts(d)};EditorUi.prototype.createSvgDataUri=function(d){EditorUi.logEvent("SHOULD NOT BE CALLED: createSvgDataUri");return Editor.createSvgDataUri(d)};EditorUi.prototype.embedCssFonts=function(d,f){EditorUi.logEvent("SHOULD NOT BE CALLED: embedCssFonts");return this.editor.embedCssFonts(d,


1),!1));c.push(new mxConnectionConstraint(new mxPoint(1,.5),!1));m>=2*n&&c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));return c};p.prototype.getConstraints=function(c,m,v){c=[];var n=Math.max(0,Math.min(m,Math.min(v,parseFloat(mxUtils.getValue(this.style,"size",this.size)))));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m-n),0));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m-n,0));c.push(new mxConnectionConstraint(new mxPoint(0,
0),!1,null,m-.5*n,.5*n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,.5*(v+n)));c.push(new mxConnectionConstraint(new mxPoint(1,1),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m+n),v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,n,v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*n,v-.5*n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,v-n));c.push(new mxConnectionConstraint(new mxPoint(0,
0),!1,null,0,.5*(v-n)));return c};d.prototype.getConstraints=function(c,m,v){c=[];m=Math.max(0,Math.min(v,parseFloat(mxUtils.getValue(this.style,"size",this.size))));c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));c.push(new mxConnectionConstraint(new mxPoint(0,.5),!1));c.push(new mxConnectionConstraint(new mxPoint(.5,1),!1));c.push(new mxConnectionConstraint(new mxPoint(1,.5),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,m));c.push(new mxConnectionConstraint(new mxPoint(1,


0),!1,null,m,.5*(v+n)));c.push(new mxConnectionConstraint(new mxPoint(1,1),!1));c.push(new mxConnectionConstraint(new mxPoint(.5,1),!1));c.push(new mxConnectionConstraint(new mxPoint(0,1),!1));c.push(new mxConnectionConstraint(new mxPoint(0,.5),!1));m>=2*n&&c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));return c};z.prototype.getConstraints=function(c,m,v){c=[];var n=Math.max(0,Math.min(m,Math.min(v,parseFloat(mxUtils.getValue(this.style,"size",this.size)))));c.push(new mxConnectionConstraint(new mxPoint(1,
0),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m+n),0));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,n,0));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*n,.5*n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,.5*(v+n)));c.push(new mxConnectionConstraint(new mxPoint(0,1),!1));c.push(new mxConnectionConstraint(new mxPoint(.5,1),!1));c.push(new mxConnectionConstraint(new mxPoint(1,
1),!1));c.push(new mxConnectionConstraint(new mxPoint(1,.5),!1));m>=2*n&&c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));return c};p.prototype.getConstraints=function(c,m,v){c=[];var n=Math.max(0,Math.min(m,Math.min(v,parseFloat(mxUtils.getValue(this.style,"size",this.size)))));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m-n),0));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m-n,0));c.push(new mxConnectionConstraint(new mxPoint(0,


f)};EditorUi.prototype.embedExtFonts=function(d){EditorUi.logEvent("SHOULD NOT BE CALLED: embedExtFonts");return this.editor.embedExtFonts(d)};EditorUi.prototype.exportToCanvas=function(d,f,k,u,z,C,F,K,O,H,ka,fa,ca,ja,ma,aa){EditorUi.logEvent("SHOULD NOT BE CALLED: exportToCanvas");return this.editor.exportToCanvas(d,f,k,u,z,C,F,K,O,H,ka,fa,ca,ja,ma,aa)};EditorUi.prototype.createImageUrlConverter=function(){EditorUi.logEvent("SHOULD NOT BE CALLED: createImageUrlConverter");return this.editor.createImageUrlConverter()};


PrintDialog.createPrintPreview=function(b,e,g,p,y,q,E){e=new mxPrintPreview(b,e,g,p,y,q);e.title=mxResources.get("preview");e.addPageCss=!mxClient.IS_SF;e.printBackgroundImage=!0;e.autoOrigin=E;b=b.background;if(null==b||""==b||b==mxConstants.NONE)b="#ffffff";e.backgroundColor=b;var L=e.writeHead;e.writeHead=function(T){L.apply(this,arguments);T.writeln('<style type="text/css">');T.writeln("@media screen {");T.writeln("  body > div { padding:30px;box-sizing:content-box; }");T.writeln("}");T.writeln("</style>")};
return e};PrintDialog.previewEnabled=!0;


this.sidebarWindow.window.addListener(mxEvent.SHOW,mxUtils.bind(this,function(){this.sidebarWindow.window.fit()}));this.sidebarWindow.window.minimumSize=new mxRectangle(0,0,90,90);this.sidebarWindow.window.setVisible(!1)}};EditorUi.prototype.setSketchMode=function(d){this.spinner.spin(document.body,mxResources.get("working")+"...")&&window.setTimeout(mxUtils.bind(this,function(){this.spinner.stop();this.doSetSketchMode(d);null==urlParams.rough&&(mxSettings.settings.sketchMode=d,mxSettings.save());
this.fireEvent(new mxEventObject("sketchModeChanged"))}),0)};Editor.createMinimalCss=function(){return(Editor.isDarkMode()?"html body .geMenubarContainer .geMenuItem .geMenuItem, html body .geMenubarContainer a.geMenuItem { color: #353535; }html body .geToolbarContainer .geMenuItem, html body .geToolbarContainer .geToolbarButton, html body .geMenubarContainer .geMenuItem .geMenuItem, html body .geMenubarContainer a.geMenuItem,html body .geMenubarContainer .geToolbarButton { filter: invert(1); }html > body.geEditor > div > a.geItem { background-color: "+


function(d,f,k,u,z,C,F,K){EditorUi.logEvent("SHOULD NOT BE CALLED: loadUrl");return this.editor.loadUrl(d,f,k,u,z,C,F,K)};EditorUi.prototype.loadFonts=function(d){EditorUi.logEvent("SHOULD NOT BE CALLED: loadFonts");return this.editor.loadFonts(d)};EditorUi.prototype.createSvgDataUri=function(d){EditorUi.logEvent("SHOULD NOT BE CALLED: createSvgDataUri");return Editor.createSvgDataUri(d)};EditorUi.prototype.embedCssFonts=function(d,f){EditorUi.logEvent("SHOULD NOT BE CALLED: embedCssFonts");return this.editor.embedCssFonts(d,
f)};EditorUi.prototype.embedExtFonts=function(d){EditorUi.logEvent("SHOULD NOT BE CALLED: embedExtFonts");return this.editor.embedExtFonts(d)};EditorUi.prototype.exportToCanvas=function(d,f,k,u,z,C,F,K,O,H,ka,fa,ca,ja,ma,aa){EditorUi.logEvent("SHOULD NOT BE CALLED: exportToCanvas");return this.editor.exportToCanvas(d,f,k,u,z,C,F,K,O,H,ka,fa,ca,ja,ma,aa)};EditorUi.prototype.createImageUrlConverter=function(){EditorUi.logEvent("SHOULD NOT BE CALLED: createImageUrlConverter");return this.editor.createImageUrlConverter()};


EditorUi.prototype.getLinkForPage=function(b,e,g){if(null!=b&&!mxClient.IS_CHROMEAPP&&!EditorUi.isElectronApp){var p=this.getCurrentFile();if(null!=p&&p.constructor!=LocalFile&&"draw.io"==this.getServiceName()){var y=this.getSearch("create title mode url drive splash state clibs ui viewbox hide-pages sketch".split(" "));y+=(0==y.length?"?":"&")+"page-id="+b.getId();null!=e&&(y+="&"+e.join("&"));return(g&&"1"!=urlParams.dev?EditorUi.lightboxHost:mxClient.IS_CHROMEAPP||EditorUi.isElectronApp||!/.*\.draw\.io$/.test(window.location.hostname)?
EditorUi.drawHost:"https://"+window.location.host)+"/"+y+"#"+p.getHash()}}return null};


E.setAttribute("width",g+"px");E.setAttribute("height",p+"px");E.setAttribute("viewBox",b+" "+e+" "+g+" "+p);q.appendChild(E);return E};Graph.htmlToPng=function(b,e,g,p){var y=document.createElement("canvas");y.width=e;y.height=g;var q=document.createElement("img");q.onload=mxUtils.bind(this,function(){y.getContext("2d").drawImage(q,0,0);p(y.toDataURL())});q.src="data:image/svg+xml,"+encodeURIComponent('<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100"><foreignObject width="100%" height="100%">
I lick cheese
</foreignObject></svg>')};


function X(){mxShape.call(this)}function U(){mxShape.call(this)}function Z(){mxRectangleShape.call(this)}function ba(){mxShape.call(this)}function ia(){mxShape.call(this)}function qa(){mxShape.call(this)}function ra(){mxShape.call(this)}function pa(){mxShape.call(this)}function xa(){mxCylinder.call(this)}function Ca(){mxCylinder.call(this)}function Aa(){mxRectangleShape.call(this)}function za(){mxDoubleEllipse.call(this)}function Ma(){mxDoubleEllipse.call(this)}function Qa(){mxArrowConnector.call(this);
this.spacing=0}function Oa(){mxArrowConnector.call(this);this.spacing=0}function ta(){mxActor.call(this)}function Da(){mxRectangleShape.call(this)}function Ba(){mxActor.call(this)}function ya(){mxActor.call(this)}function Va(){mxActor.call(this)}function Wa(){mxActor.call(this)}function La(){mxActor.call(this)}function $a(){mxActor.call(this)}function Ea(){mxActor.call(this)}function Ka(){mxActor.call(this)}function x(){mxActor.call(this)}function J(){mxActor.call(this)}function Q(){mxEllipse.call(this)}


T="curved sourcePerimeterSpacing targetPerimeterSpacing startArrow startFill startSize endArrow endFill endSize".split(" "),G=!1,M=!1;this.setDefaultStyle=function(P){try{y.getModel().isEdge(P)?M=!1:G=!1;var V=y.getCellStyle(P,!1),l=[],A=[],N;for(N in V)l.push(V[N]),A.push(N);y.getModel().isEdge(P)?y.currentEdgeStyle={}:y.currentVertexStyle={};this.fireEvent(new mxEventObject("styleChanged","keys",A,"values",l,"cells",[P],"force",!0));y.getModel().isEdge(P)?M=!0:G=!0}catch(X){this.handleError(X)}};


function(c,m,v){c=[];var n=Math.max(0,Math.min(m,Math.min(v,parseFloat(mxUtils.getValue(this.style,"size",this.size)))));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m-n),0));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m-n,0));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m-.5*n,.5*n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,n));c.push(new mxConnectionConstraint(new mxPoint(0,
0),!1,null,m,.5*(v+n)));c.push(new mxConnectionConstraint(new mxPoint(1,1),!1));c.push(new mxConnectionConstraint(new mxPoint(.5,1),!1));c.push(new mxConnectionConstraint(new mxPoint(0,1),!1));c.push(new mxConnectionConstraint(new mxPoint(0,.5),!1));m>=2*n&&c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));return c};z.prototype.getConstraints=function(c,m,v){c=[];var n=Math.max(0,Math.min(m,Math.min(v,parseFloat(mxUtils.getValue(this.style,"size",this.size)))));c.push(new mxConnectionConstraint(new mxPoint(1,


!0),new mxConnectionConstraint(new mxPoint(1,.5),!0),new mxConnectionConstraint(new mxPoint(1,.75),!0)];mxArrow.prototype.constraints=null;Va.prototype.getConstraints=function(c,m,v){c=[];var n=Math.max(0,Math.min(m,parseFloat(mxUtils.getValue(this.style,"dx",this.dx)))),t=Math.max(0,Math.min(v,parseFloat(mxUtils.getValue(this.style,"dy",this.dy))));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1));c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));c.push(new mxConnectionConstraint(new mxPoint(1,
0),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,.5*t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.75*m+.25*n,t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m+n),t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m+n),.5*(v+t)));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m+n),v));c.push(new mxConnectionConstraint(new mxPoint(.5,1),!1));c.push(new mxConnectionConstraint(new mxPoint(0,
0),!1,null,.5*(m-n),v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m-n),.5*(v+t)));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m-n),t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.25*m-.25*n,t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,.5*t));return c};Ba.prototype.getConstraints=function(c,m,v){c=[];var n=Math.max(0,Math.min(m,parseFloat(mxUtils.getValue(this.style,


Graph.createSvgImage=function(b,e,g,p,y){g=unescape(encodeURIComponent(Graph.svgDoctype+'<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="'+b+'px" height="'+e+'px" '+(null!=p&&null!=y?'viewBox="0 0 '+p+" "+y+'" ':"")+'version="1.1">'+g+"</svg>"));return new mxImage("data:image/svg+xml;base64,"+(window.btoa?btoa(g):Base64.encode(g,!0)),b,e)};


Uint8Array.from||(Uint8Array.from=function(){var b=Object.prototype.toString,e=function(p){return"function"===typeof p||"[object Function]"===b.call(p)},g=Math.pow(2,53)-1;return function(p){var y=Object(p);if(null==p)throw new TypeError("Array.from requires an array-like object - not null or undefined");var q=1<arguments.length?arguments[1]:void 0,E;if("undefined"!==typeof q){if(!e(q))throw new TypeError("Array.from: when provided, the second argument must be a function");2<arguments.length&&(E=


function X(){mxShape.call(this)}function U(){mxShape.call(this)}function Z(){mxRectangleShape.call(this)}function ba(){mxShape.call(this)}function ia(){mxShape.call(this)}function qa(){mxShape.call(this)}function ra(){mxShape.call(this)}function pa(){mxShape.call(this)}function xa(){mxCylinder.call(this)}function Ca(){mxCylinder.call(this)}function Aa(){mxRectangleShape.call(this)}function za(){mxDoubleEllipse.call(this)}function Ma(){mxDoubleEllipse.call(this)}function Qa(){mxArrowConnector.call(this);


mxResources.get("mermaid")+"...","mermaid");W.showDialog(k.container,620,420,!0,!1);k.init()}));var d="horizontalFlow verticalFlow - horizontalTree verticalTree radialTree - organic circle".split(" "),f=function(k,u,z,C){k.addItem(z,null,mxUtils.bind(this,function(){var F=new CreateGraphDialog(W,z,C);W.showDialog(F.container,620,420,!0,!1);F.init()}),u)};this.put("insertLayout",new Menu(mxUtils.bind(this,function(k,u){for(var z=0;z<d.length;z++)"-"==d[z]?k.addSeparator(u):f(k,u,mxResources.get(d[z])+


.5),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,v-n));c.push(new mxConnectionConstraint(new mxPoint(.5,1),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,v-n));c.push(new mxConnectionConstraint(new mxPoint(0,.5),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,n));return c};ma.prototype.getConstraints=function(c,m,v){c=[];mxUtils.getValue(this.style,mxConstants.STYLE_ARCSIZE,mxConstants.LINE_ARCSIZE);var n=Math.max(0,Math.min(v,parseFloat(mxUtils.getValue(this.style,
"size",this.size))));parseFloat(mxUtils.getValue(this.style,"position",this.position));var t=m*Math.max(0,Math.min(1,parseFloat(mxUtils.getValue(this.style,"position2",this.position2))));parseFloat(mxUtils.getValue(this.style,"base",this.base));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1));c.push(new mxConnectionConstraint(new mxPoint(.25,0),!1));c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));c.push(new mxConnectionConstraint(new mxPoint(.75,0),!1));c.push(new mxConnectionConstraint(new mxPoint(1,
0),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,.5*(v-n)));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,v-n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,t,v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,v-n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,.5*(v-n)));m>=2*n&&c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));return c};mxRectangleShape.prototype.constraints=[new mxConnectionConstraint(new mxPoint(0,


0),!1,null,m-n,v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(t+m-n),v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,t,v));return c};xa.prototype.getConstraints=function(c,m,v){m=parseFloat(mxUtils.getValue(c,"jettyWidth",xa.prototype.jettyWidth))/2;c=parseFloat(mxUtils.getValue(c,"jettyHeight",xa.prototype.jettyHeight));var n=[new mxConnectionConstraint(new mxPoint(0,0),!1,null,m),new mxConnectionConstraint(new mxPoint(.25,0),!0),new mxConnectionConstraint(new mxPoint(.5,
0),!0),new mxConnectionConstraint(new mxPoint(.75,0),!0),new mxConnectionConstraint(new mxPoint(1,0),!0),new mxConnectionConstraint(new mxPoint(1,.25),!0),new mxConnectionConstraint(new mxPoint(1,.5),!0),new mxConnectionConstraint(new mxPoint(1,.75),!0),new mxConnectionConstraint(new mxPoint(0,1),!1,null,m),new mxConnectionConstraint(new mxPoint(.25,1),!0),new mxConnectionConstraint(new mxPoint(.5,1),!0),new mxConnectionConstraint(new mxPoint(.75,1),!0),new mxConnectionConstraint(new mxPoint(1,1),
!0),new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,Math.min(v-.5*c,1.5*c)),new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,Math.min(v-.5*c,3.5*c))];v>5*c&&n.push(new mxConnectionConstraint(new mxPoint(0,.75),!1,null,m));v>8*c&&n.push(new mxConnectionConstraint(new mxPoint(0,.5),!1,null,m));v>15*c&&n.push(new mxConnectionConstraint(new mxPoint(0,.25),!1,null,m));return n};x.prototype.constraints=mxRectangleShape.prototype.constraints;J.prototype.constraints=mxRectangleShape.prototype.constraints;


1),!1),new mxConnectionConstraint(new mxPoint(.25,.5),!1),new mxConnectionConstraint(new mxPoint(.5,.5),!1),new mxConnectionConstraint(new mxPoint(.75,.5),!1),new mxConnectionConstraint(new mxPoint(1,0),!1),new mxConnectionConstraint(new mxPoint(1,.5),!1),new mxConnectionConstraint(new mxPoint(1,1),!1)];Wa.prototype.getConstraints=function(c,m,v){c=[];var n=v*Math.max(0,Math.min(1,parseFloat(mxUtils.getValue(this.style,"arrowWidth",this.arrowWidth)))),t=m*Math.max(0,Math.min(1,parseFloat(mxUtils.getValue(this.style,
"arrowSize",this.arrowSize))));n=(v-n)/2;c.push(new mxConnectionConstraint(new mxPoint(0,.5),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m-t),n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m-t,0));c.push(new mxConnectionConstraint(new mxPoint(1,.5),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m-t,v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m-t),v-n));c.push(new mxConnectionConstraint(new mxPoint(0,
0),!1,null,0,v-n));return c};La.prototype.getConstraints=function(c,m,v){c=[];var n=v*Math.max(0,Math.min(1,parseFloat(mxUtils.getValue(this.style,"arrowWidth",Wa.prototype.arrowWidth)))),t=m*Math.max(0,Math.min(1,parseFloat(mxUtils.getValue(this.style,"arrowSize",Wa.prototype.arrowSize))));n=(v-n)/2;c.push(new mxConnectionConstraint(new mxPoint(0,.5),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,t,0));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*m,n));c.push(new mxConnectionConstraint(new mxPoint(0,


function(c,m,v){c=[];var n=Math.min(m,v/2),t=Math.min(m-n,Math.max(0,parseFloat(mxUtils.getValue(this.style,"size",this.size)))*m);c.push(new mxConnectionConstraint(new mxPoint(0,.5),!1,null));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,t,0));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(t+m-n),0));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m-n,0));c.push(new mxConnectionConstraint(new mxPoint(1,.5),!1,null));c.push(new mxConnectionConstraint(new mxPoint(0,
0),!1,null,m-n,v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(t+m-n),v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,t,v));return c};xa.prototype.getConstraints=function(c,m,v){m=parseFloat(mxUtils.getValue(c,"jettyWidth",xa.prototype.jettyWidth))/2;c=parseFloat(mxUtils.getValue(c,"jettyHeight",xa.prototype.jettyHeight));var n=[new mxConnectionConstraint(new mxPoint(0,0),!1,null,m),new mxConnectionConstraint(new mxPoint(.25,0),!0),new mxConnectionConstraint(new mxPoint(.5,


0),!1,null,.5*(m-n),v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m-n),.5*(v+t)));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m-n),t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.25*m-.25*n,t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,.5*t));return c};Ba.prototype.getConstraints=function(c,m,v){c=[];var n=Math.max(0,Math.min(m,parseFloat(mxUtils.getValue(this.style,
"dx",this.dx)))),t=Math.max(0,Math.min(v,parseFloat(mxUtils.getValue(this.style,"dy",this.dy))));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1));c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));c.push(new mxConnectionConstraint(new mxPoint(1,0),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,.5*t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m+n),t));c.push(new mxConnectionConstraint(new mxPoint(0,
0),!1,null,n,t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,n,.5*(v+t)));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,n,v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*n,v));c.push(new mxConnectionConstraint(new mxPoint(0,.5),!1));c.push(new mxConnectionConstraint(new mxPoint(0,1),!1));return c};ya.prototype.constraints=[new mxConnectionConstraint(new mxPoint(0,0),!1),new mxConnectionConstraint(new mxPoint(0,.5),!1),new mxConnectionConstraint(new mxPoint(0,


Uint8Array.from||(Uint8Array.from=function(){var b=Object.prototype.toString,e=function(p){return"function"===typeof p||"[object Function]"===b.call(p)},g=Math.pow(2,53)-1;return function(p){var y=Object(p);if(null==p)throw new TypeError("Array.from requires an array-like object - not null or undefined");var q=1<arguments.length?arguments[1]:void 0,E;if("undefined"!==typeof q){if(!e(q))throw new TypeError("Array.from: when provided, the second argument must be a function");2<arguments.length&&(E=
arguments[2])}var L=Number(y.length);L=isNaN(L)?0:0!==L&&isFinite(L)?(0<L?1:-1)*Math.floor(Math.abs(L)):L;L=Math.min(Math.max(L,0),g);for(var T=e(this)?Object(new this(L)):Array(L),G=0,M;G<L;)M=y[G],T[G]=q?"undefined"===typeof E?q(M,G):q.call(E,M,G):M,G+=1;T.length=L;return T}}());mxConstants.POINTS=1;mxConstants.MILLIMETERS=2;mxConstants.INCHES=3;mxConstants.METERS=4;mxConstants.PIXELS_PER_MM=3.937;mxConstants.PIXELS_PER_INCH=100;mxConstants.SHADOW_OPACITY=.25;mxConstants.SHADOWCOLOR="#000000";


function(d,f,k,u,z,C,F,K){EditorUi.logEvent("SHOULD NOT BE CALLED: loadUrl");return this.editor.loadUrl(d,f,k,u,z,C,F,K)};EditorUi.prototype.loadFonts=function(d){EditorUi.logEvent("SHOULD NOT BE CALLED: loadFonts");return this.editor.loadFonts(d)};EditorUi.prototype.createSvgDataUri=function(d){EditorUi.logEvent("SHOULD NOT BE CALLED: createSvgDataUri");return Editor.createSvgDataUri(d)};EditorUi.prototype.embedCssFonts=function(d,f){EditorUi.logEvent("SHOULD NOT BE CALLED: embedCssFonts");return this.editor.embedCssFonts(d,


1),!1));c.push(new mxConnectionConstraint(new mxPoint(1,.5),!1));m>=2*n&&c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));return c};p.prototype.getConstraints=function(c,m,v){c=[];var n=Math.max(0,Math.min(m,Math.min(v,parseFloat(mxUtils.getValue(this.style,"size",this.size)))));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m-n),0));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m-n,0));c.push(new mxConnectionConstraint(new mxPoint(0,
0),!1,null,m-.5*n,.5*n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,.5*(v+n)));c.push(new mxConnectionConstraint(new mxPoint(1,1),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m+n),v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,n,v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*n,v-.5*n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,v-n));c.push(new mxConnectionConstraint(new mxPoint(0,
0),!1,null,0,.5*(v-n)));return c};d.prototype.getConstraints=function(c,m,v){c=[];m=Math.max(0,Math.min(v,parseFloat(mxUtils.getValue(this.style,"size",this.size))));c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));c.push(new mxConnectionConstraint(new mxPoint(0,.5),!1));c.push(new mxConnectionConstraint(new mxPoint(.5,1),!1));c.push(new mxConnectionConstraint(new mxPoint(1,.5),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,m));c.push(new mxConnectionConstraint(new mxPoint(1,


0),!1,null,m,.5*(v+n)));c.push(new mxConnectionConstraint(new mxPoint(1,1),!1));c.push(new mxConnectionConstraint(new mxPoint(.5,1),!1));c.push(new mxConnectionConstraint(new mxPoint(0,1),!1));c.push(new mxConnectionConstraint(new mxPoint(0,.5),!1));m>=2*n&&c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));return c};z.prototype.getConstraints=function(c,m,v){c=[];var n=Math.max(0,Math.min(m,Math.min(v,parseFloat(mxUtils.getValue(this.style,"size",this.size)))));c.push(new mxConnectionConstraint(new mxPoint(1,
0),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m+n),0));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,n,0));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*n,.5*n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,.5*(v+n)));c.push(new mxConnectionConstraint(new mxPoint(0,1),!1));c.push(new mxConnectionConstraint(new mxPoint(.5,1),!1));c.push(new mxConnectionConstraint(new mxPoint(1,
1),!1));c.push(new mxConnectionConstraint(new mxPoint(1,.5),!1));m>=2*n&&c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));return c};p.prototype.getConstraints=function(c,m,v){c=[];var n=Math.max(0,Math.min(m,Math.min(v,parseFloat(mxUtils.getValue(this.style,"size",this.size)))));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m-n),0));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m-n,0));c.push(new mxConnectionConstraint(new mxPoint(0,


f)};EditorUi.prototype.embedExtFonts=function(d){EditorUi.logEvent("SHOULD NOT BE CALLED: embedExtFonts");return this.editor.embedExtFonts(d)};EditorUi.prototype.exportToCanvas=function(d,f,k,u,z,C,F,K,O,H,ka,fa,ca,ja,ma,aa){EditorUi.logEvent("SHOULD NOT BE CALLED: exportToCanvas");return this.editor.exportToCanvas(d,f,k,u,z,C,F,K,O,H,ka,fa,ca,ja,ma,aa)};EditorUi.prototype.createImageUrlConverter=function(){EditorUi.logEvent("SHOULD NOT BE CALLED: createImageUrlConverter");return this.editor.createImageUrlConverter()};


PrintDialog.createPrintPreview=function(b,e,g,p,y,q,E){e=new mxPrintPreview(b,e,g,p,y,q);e.title=mxResources.get("preview");e.addPageCss=!mxClient.IS_SF;e.printBackgroundImage=!0;e.autoOrigin=E;b=b.background;if(null==b||""==b||b==mxConstants.NONE)b="#ffffff";e.backgroundColor=b;var L=e.writeHead;e.writeHead=function(T){L.apply(this,arguments);T.writeln('<style type="text/css">');T.writeln("@media screen {");T.writeln("  body > div { padding:30px;box-sizing:content-box; }");T.writeln("}");T.writeln("</style>")};
return e};PrintDialog.previewEnabled=!0;


this.sidebarWindow.window.addListener(mxEvent.SHOW,mxUtils.bind(this,function(){this.sidebarWindow.window.fit()}));this.sidebarWindow.window.minimumSize=new mxRectangle(0,0,90,90);this.sidebarWindow.window.setVisible(!1)}};EditorUi.prototype.setSketchMode=function(d){this.spinner.spin(document.body,mxResources.get("working")+"...")&&window.setTimeout(mxUtils.bind(this,function(){this.spinner.stop();this.doSetSketchMode(d);null==urlParams.rough&&(mxSettings.settings.sketchMode=d,mxSettings.save());
this.fireEvent(new mxEventObject("sketchModeChanged"))}),0)};Editor.createMinimalCss=function(){return(Editor.isDarkMode()?"html body .geMenubarContainer .geMenuItem .geMenuItem, html body .geMenubarContainer a.geMenuItem { color: #353535; }html body .geToolbarContainer .geMenuItem, html body .geToolbarContainer .geToolbarButton, html body .geMenubarContainer .geMenuItem .geMenuItem, html body .geMenubarContainer a.geMenuItem,html body .geMenubarContainer .geToolbarButton { filter: invert(1); }html > body.geEditor > div > a.geItem { background-color: "+


function(d,f,k,u,z,C,F,K){EditorUi.logEvent("SHOULD NOT BE CALLED: loadUrl");return this.editor.loadUrl(d,f,k,u,z,C,F,K)};EditorUi.prototype.loadFonts=function(d){EditorUi.logEvent("SHOULD NOT BE CALLED: loadFonts");return this.editor.loadFonts(d)};EditorUi.prototype.createSvgDataUri=function(d){EditorUi.logEvent("SHOULD NOT BE CALLED: createSvgDataUri");return Editor.createSvgDataUri(d)};EditorUi.prototype.embedCssFonts=function(d,f){EditorUi.logEvent("SHOULD NOT BE CALLED: embedCssFonts");return this.editor.embedCssFonts(d,
f)};EditorUi.prototype.embedExtFonts=function(d){EditorUi.logEvent("SHOULD NOT BE CALLED: embedExtFonts");return this.editor.embedExtFonts(d)};EditorUi.prototype.exportToCanvas=function(d,f,k,u,z,C,F,K,O,H,ka,fa,ca,ja,ma,aa){EditorUi.logEvent("SHOULD NOT BE CALLED: exportToCanvas");return this.editor.exportToCanvas(d,f,k,u,z,C,F,K,O,H,ka,fa,ca,ja,ma,aa)};EditorUi.prototype.createImageUrlConverter=function(){EditorUi.logEvent("SHOULD NOT BE CALLED: createImageUrlConverter");return this.editor.createImageUrlConverter()};


EditorUi.prototype.getLinkForPage=function(b,e,g){if(null!=b&&!mxClient.IS_CHROMEAPP&&!EditorUi.isElectronApp){var p=this.getCurrentFile();if(null!=p&&p.constructor!=LocalFile&&"draw.io"==this.getServiceName()){var y=this.getSearch("create title mode url drive splash state clibs ui viewbox hide-pages sketch".split(" "));y+=(0==y.length?"?":"&")+"page-id="+b.getId();null!=e&&(y+="&"+e.join("&"));return(g&&"1"!=urlParams.dev?EditorUi.lightboxHost:mxClient.IS_CHROMEAPP||EditorUi.isElectronApp||!/.*\.draw\.io$/.test(window.location.hostname)?
EditorUi.drawHost:"https://"+window.location.host)+"/"+y+"#"+p.getHash()}}return null};


E.setAttribute("width",g+"px");E.setAttribute("height",p+"px");E.setAttribute("viewBox",b+" "+e+" "+g+" "+p);q.appendChild(E);return E};Graph.htmlToPng=function(b,e,g,p){var y=document.createElement("canvas");y.width=e;y.height=g;var q=document.createElement("img");q.onload=mxUtils.bind(this,function(){y.getContext("2d").drawImage(q,0,0);p(y.toDataURL())});q.src="data:image/svg+xml,"+encodeURIComponent('<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100"><foreignObject width="100%" height="100%">
I lick cheese
</foreignObject></svg>')};


function X(){mxShape.call(this)}function U(){mxShape.call(this)}function Z(){mxRectangleShape.call(this)}function ba(){mxShape.call(this)}function ia(){mxShape.call(this)}function qa(){mxShape.call(this)}function ra(){mxShape.call(this)}function pa(){mxShape.call(this)}function xa(){mxCylinder.call(this)}function Ca(){mxCylinder.call(this)}function Aa(){mxRectangleShape.call(this)}function za(){mxDoubleEllipse.call(this)}function Ma(){mxDoubleEllipse.call(this)}function Qa(){mxArrowConnector.call(this);
this.spacing=0}function Oa(){mxArrowConnector.call(this);this.spacing=0}function ta(){mxActor.call(this)}function Da(){mxRectangleShape.call(this)}function Ba(){mxActor.call(this)}function ya(){mxActor.call(this)}function Va(){mxActor.call(this)}function Wa(){mxActor.call(this)}function La(){mxActor.call(this)}function $a(){mxActor.call(this)}function Ea(){mxActor.call(this)}function Ka(){mxActor.call(this)}function x(){mxActor.call(this)}function J(){mxActor.call(this)}function Q(){mxEllipse.call(this)}


function X(){mxShape.call(this)}function U(){mxShape.call(this)}function Z(){mxRectangleShape.call(this)}function ba(){mxShape.call(this)}function ia(){mxShape.call(this)}function qa(){mxShape.call(this)}function ra(){mxShape.call(this)}function pa(){mxShape.call(this)}function xa(){mxCylinder.call(this)}function Ca(){mxCylinder.call(this)}function Aa(){mxRectangleShape.call(this)}function za(){mxDoubleEllipse.call(this)}function Ma(){mxDoubleEllipse.call(this)}function Qa(){mxArrowConnector.call(this);


T="curved sourcePerimeterSpacing targetPerimeterSpacing startArrow startFill startSize endArrow endFill endSize".split(" "),G=!1,M=!1;this.setDefaultStyle=function(P){try{y.getModel().isEdge(P)?M=!1:G=!1;var V=y.getCellStyle(P,!1),l=[],A=[],N;for(N in V)l.push(V[N]),A.push(N);y.getModel().isEdge(P)?y.currentEdgeStyle={}:y.currentVertexStyle={};this.fireEvent(new mxEventObject("styleChanged","keys",A,"values",l,"cells",[P],"force",!0));y.getModel().isEdge(P)?M=!0:G=!0}catch(X){this.handleError(X)}};


function(c,m,v){c=[];var n=Math.max(0,Math.min(m,Math.min(v,parseFloat(mxUtils.getValue(this.style,"size",this.size)))));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m-n),0));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m-n,0));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m-.5*n,.5*n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,n));c.push(new mxConnectionConstraint(new mxPoint(0,
0),!1,null,m,.5*(v+n)));c.push(new mxConnectionConstraint(new mxPoint(1,1),!1));c.push(new mxConnectionConstraint(new mxPoint(.5,1),!1));c.push(new mxConnectionConstraint(new mxPoint(0,1),!1));c.push(new mxConnectionConstraint(new mxPoint(0,.5),!1));m>=2*n&&c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));return c};z.prototype.getConstraints=function(c,m,v){c=[];var n=Math.max(0,Math.min(m,Math.min(v,parseFloat(mxUtils.getValue(this.style,"size",this.size)))));c.push(new mxConnectionConstraint(new mxPoint(1,


!0),new mxConnectionConstraint(new mxPoint(1,.5),!0),new mxConnectionConstraint(new mxPoint(1,.75),!0)];mxArrow.prototype.constraints=null;Va.prototype.getConstraints=function(c,m,v){c=[];var n=Math.max(0,Math.min(m,parseFloat(mxUtils.getValue(this.style,"dx",this.dx)))),t=Math.max(0,Math.min(v,parseFloat(mxUtils.getValue(this.style,"dy",this.dy))));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1));c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));c.push(new mxConnectionConstraint(new mxPoint(1,
0),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,.5*t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.75*m+.25*n,t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m+n),t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m+n),.5*(v+t)));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m+n),v));c.push(new mxConnectionConstraint(new mxPoint(.5,1),!1));c.push(new mxConnectionConstraint(new mxPoint(0,
0),!1,null,.5*(m-n),v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m-n),.5*(v+t)));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m-n),t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.25*m-.25*n,t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,t));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,.5*t));return c};Ba.prototype.getConstraints=function(c,m,v){c=[];var n=Math.max(0,Math.min(m,parseFloat(mxUtils.getValue(this.style,


Graph.createSvgImage=function(b,e,g,p,y){g=unescape(encodeURIComponent(Graph.svgDoctype+'<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="'+b+'px" height="'+e+'px" '+(null!=p&&null!=y?'viewBox="0 0 '+p+" "+y+'" ':"")+'version="1.1">'+g+"</svg>"));return new mxImage("data:image/svg+xml;base64,"+(window.btoa?btoa(g):Base64.encode(g,!0)),b,e)};


Uint8Array.from||(Uint8Array.from=function(){var b=Object.prototype.toString,e=function(p){return"function"===typeof p||"[object Function]"===b.call(p)},g=Math.pow(2,53)-1;return function(p){var y=Object(p);if(null==p)throw new TypeError("Array.from requires an array-like object - not null or undefined");var q=1<arguments.length?arguments[1]:void 0,E;if("undefined"!==typeof q){if(!e(q))throw new TypeError("Array.from: when provided, the second argument must be a function");2<arguments.length&&(E=


mxResources.get("mermaid")+"...","mermaid");W.showDialog(k.container,620,420,!0,!1);k.init()}));var d="horizontalFlow verticalFlow - horizontalTree verticalTree radialTree - organic circle".split(" "),f=function(k,u,z,C){k.addItem(z,null,mxUtils.bind(this,function(){var F=new CreateGraphDialog(W,z,C);W.showDialog(F.container,620,420,!0,!1);F.init()}),u)};this.put("insertLayout",new Menu(mxUtils.bind(this,function(k,u){for(var z=0;z<d.length;z++)"-"==d[z]?k.addSeparator(u):f(k,u,mxResources.get(d[z])+


.5),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,v-n));c.push(new mxConnectionConstraint(new mxPoint(.5,1),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,v-n));c.push(new mxConnectionConstraint(new mxPoint(0,.5),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,n));return c};ma.prototype.getConstraints=function(c,m,v){c=[];mxUtils.getValue(this.style,mxConstants.STYLE_ARCSIZE,mxConstants.LINE_ARCSIZE);var n=Math.max(0,Math.min(v,parseFloat(mxUtils.getValue(this.style,
"size",this.size))));parseFloat(mxUtils.getValue(this.style,"position",this.position));var t=m*Math.max(0,Math.min(1,parseFloat(mxUtils.getValue(this.style,"position2",this.position2))));parseFloat(mxUtils.getValue(this.style,"base",this.base));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1));c.push(new mxConnectionConstraint(new mxPoint(.25,0),!1));c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));c.push(new mxConnectionConstraint(new mxPoint(.75,0),!1));c.push(new mxConnectionConstraint(new mxPoint(1,
0),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,.5*(v-n)));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,v-n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,t,v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,v-n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,.5*(v-n)));m>=2*n&&c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));return c};mxRectangleShape.prototype.constraints=[new mxConnectionConstraint(new mxPoint(0,


0),!1,null,m-n,v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(t+m-n),v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,t,v));return c};xa.prototype.getConstraints=function(c,m,v){m=parseFloat(mxUtils.getValue(c,"jettyWidth",xa.prototype.jettyWidth))/2;c=parseFloat(mxUtils.getValue(c,"jettyHeight",xa.prototype.jettyHeight));var n=[new mxConnectionConstraint(new mxPoint(0,0),!1,null,m),new mxConnectionConstraint(new mxPoint(.25,0),!0),new mxConnectionConstraint(new mxPoint(.5,
0),!0),new mxConnectionConstraint(new mxPoint(.75,0),!0),new mxConnectionConstraint(new mxPoint(1,0),!0),new mxConnectionConstraint(new mxPoint(1,.25),!0),new mxConnectionConstraint(new mxPoint(1,.5),!0),new mxConnectionConstraint(new mxPoint(1,.75),!0),new mxConnectionConstraint(new mxPoint(0,1),!1,null,m),new mxConnectionConstraint(new mxPoint(.25,1),!0),new mxConnectionConstraint(new mxPoint(.5,1),!0),new mxConnectionConstraint(new mxPoint(.75,1),!0),new mxConnectionConstraint(new mxPoint(1,1),
!0),new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,Math.min(v-.5*c,1.5*c)),new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,Math.min(v-.5*c,3.5*c))];v>5*c&&n.push(new mxConnectionConstraint(new mxPoint(0,.75),!1,null,m));v>8*c&&n.push(new mxConnectionConstraint(new mxPoint(0,.5),!1,null,m));v>15*c&&n.push(new mxConnectionConstraint(new mxPoint(0,.25),!1,null,m));return n};x.prototype.constraints=mxRectangleShape.prototype.constraints;J.prototype.constraints=mxRectangleShape.prototype.constraints;


1),!1),new mxConnectionConstraint(new mxPoint(.25,.5),!1),new mxConnectionConstraint(new mxPoint(.5,.5),!1),new mxConnectionConstraint(new mxPoint(.75,.5),!1),new mxConnectionConstraint(new mxPoint(1,0),!1),new mxConnectionConstraint(new mxPoint(1,.5),!1),new mxConnectionConstraint(new mxPoint(1,1),!1)];Wa.prototype.getConstraints=function(c,m,v){c=[];var n=v*Math.max(0,Math.min(1,parseFloat(mxUtils.getValue(this.style,"arrowWidth",this.arrowWidth)))),t=m*Math.max(0,Math.min(1,parseFloat(mxUtils.getValue(this.style,
"arrowSize",this.arrowSize))));n=(v-n)/2;c.push(new mxConnectionConstraint(new mxPoint(0,.5),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m-t),n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m-t,0));c.push(new mxConnectionConstraint(new mxPoint(1,.5),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m-t,v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*(m-t),v-n));c.push(new mxConnectionConstraint(new mxPoint(0,
0),!1,null,0,v-n));return c};La.prototype.getConstraints=function(c,m,v){c=[];var n=v*Math.max(0,Math.min(1,parseFloat(mxUtils.getValue(this.style,"arrowWidth",Wa.prototype.arrowWidth)))),t=m*Math.max(0,Math.min(1,parseFloat(mxUtils.getValue(this.style,"arrowSize",Wa.prototype.arrowSize))));n=(v-n)/2;c.push(new mxConnectionConstraint(new mxPoint(0,.5),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,t,0));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,.5*m,n));c.push(new mxConnectionConstraint(new mxPoint(0,


Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.


EditorUi.debug("[Performance] EditorUi.clonePages",[this],"time",Date.now()-l+" ms","args",arguments);return y});null!=K?(c.getHashValueForPages=K,K=null):(K=c.getHashValueForPages,c.getHashValueForPages=function(){var l=Date.now(),y=K.apply(this,arguments);EditorUi.debug("[Performance] EditorUi.getHashValueForPages",[this],"time",Date.now()-l+" ms","args",arguments);return y});null!=H?(c.resolveCrossReferences=H,H=null):(H=c.resolveCrossReferences,c.resolveCrossReferences=function(){var l=Date.now(),
y=H.apply(this,arguments);EditorUi.debug("[Performance] EditorUi.resolveCrossReferences",[this],"time",Date.now()-l+" ms","args",arguments);return y});EditorUi.debug("[Performance]",null!=q?"Enabled":"Disabled")}));this.put("testDevelop",new Menu(mxUtils.bind(this,function(l,y){this.addMenuItems(l,"createSidebarEntry showBoundingBox - testCheckPages testChecksum testFixPages - testCheckFile testDiff - testInspect testOptimize - testXmlImageExport -".split(" "),y);var J=l.addItem(mxResources.get("testPerformance"),


I.cell.id,I.shape),z=!1);l(I.text)||(console.log("invalid text",I.cell.id,I.text),z=!1);z||P++;p++});console.log("states checked",p,"invalid",P)}));c.actions.addAction("testCheckFile",mxUtils.bind(this,function(){var l=null!=c.pages&&null!=c.getCurrentFile()?c.getCurrentFile().getAnonymizedXmlForPages(c.pages):"";l=new TextareaDialog(c,"Paste Data:",l,function(y){if(0<y.length)try{var J=function(I){function Q(aa){if(null==fa[aa]){if(fa[aa]=!0,null!=O[aa]){for(;0<O[aa].length;){var da=O[aa].pop();
Q(da)}delete O[aa]}}else mxLog.debug(N+": Visited: "+aa)}var N=I.parentNode.id,T=I.childNodes;I={};for(var O={},W=null,X={},Z=0;Z<T.length;Z++){var Y=T[Z];if(null!=Y.id&&0<Y.id.length)if(null==I[Y.id]){I[Y.id]=Y.id;var ba=Y.getAttribute("parent");null==ba?null!=W?mxLog.debug(N+": Multiple roots: "+Y.id):W=Y.id:(null==O[ba]&&(O[ba]=[]),O[ba].push(Y.id))}else X[Y.id]=Y.id}T=Object.keys(X);0<T.length?(T=N+": "+T.length+" Duplicates: "+T.join(", "),mxLog.debug(T+" (see console)")):mxLog.debug(N+": Checked");


I.cell.id,I.shape),z=!1);l(I.text)||(console.log("invalid text",I.cell.id,I.text),z=!1);z||P++;p++});console.log("states checked",p,"invalid",P)}));c.actions.addAction("testCheckFile",mxUtils.bind(this,function(){var l=null!=c.pages&&null!=c.getCurrentFile()?c.getCurrentFile().getAnonymizedXmlForPages(c.pages):"";l=new TextareaDialog(c,"Paste Data:",l,function(y){if(0<y.length)try{var J=function(I){function Q(aa){if(null==fa[aa]){if(fa[aa]=!0,null!=O[aa]){for(;0<O[aa].length;){var da=O[aa].pop();
Q(da)}delete O[aa]}}else mxLog.debug(N+": Visited: "+aa)}var N=I.parentNode.id,T=I.childNodes;I={};for(var O={},W=null,X={},Z=0;Z<T.length;Z++){var Y=T[Z];if(null!=Y.id&&0<Y.id.length)if(null==I[Y.id]){I[Y.id]=Y.id;var ba=Y.getAttribute("parent");null==ba?null!=W?mxLog.debug(N+": Multiple roots: "+Y.id):W=Y.id:(null==O[ba]&&(O[ba]=[]),O[ba].push(Y.id))}else X[Y.id]=Y.id}T=Object.keys(X);0<T.length?(T=N+": "+T.length+" Duplicates: "+T.join(", "),mxLog.debug(T+" (see console)")):mxLog.debug(N+": Checked");
var fa={};null==W?mxLog.debug(N+": No root"):(Q(W),Object.keys(fa).length!=Object.keys(I).length&&(mxLog.debug(N+": Invalid tree: (see console)"),console.log(N+": Invalid tree",O)))};"<"!=y.charAt(0)&&(y=Graph.decompress(y),mxLog.debug("See console for uncompressed XML"),console.log("xml",y));var G=mxUtils.parseXml(y),P=c.getPagesForNode(G.documentElement,"mxGraphModel");if(null!=P&&0<P.length)try{var p=c.getHashValueForPages(P);mxLog.debug("Checksum: ",p)}catch(I){mxLog.debug("Error: ",I.message)}else mxLog.debug("No pages found for checksum");


	EditorUi.prototype.saveScrollState = function()
	{
		var t = this.editor.graph.view.translate;
		var off = mxUtils.getOffset(this.diagramContainer);
		var x = this.diagramContainer.scrollLeft - off.x;
		var y = this.diagramContainer.scrollTop - off.y;

		if (this.embedViewport != null)
		{
			if (!Editor.inlineFullscreen)
			{
				x += this.embedViewport.x;
				y += this.embedViewport.y;
			}
			else
			{
				x -= this.embedViewport.x;
				y -= this.embedViewport.y;
			}
		}

		return {x: x, y: y, tx: t.x, ty: t.y};
	};


	EditorUi.prototype.restoreScrollState = function(state)
	{
		var s = this.editor.graph.view.scale;
		var t = this.editor.graph.view.translate;
		var off = mxUtils.getOffset(this.diagramContainer);

		this.diagramContainer.scrollLeft = state.x + off.x + (t.x - state.tx) * s;
		this.diagramContainer.scrollTop = state.y + off.y + (t.y - state.ty) * s;
	};


	function renderGrid()
	{
		if (gridColor == null) return;

		var view = graph.view;
		var gridImage = btoa(unescape(encodeURIComponent(view.createSvgGrid(gridColor))));
		gridImage = 'url(' + 'data:image/svg+xml;base64,' + gridImage + ')';
		var phase = graph.gridSize * view.gridSteps * view.scale;

		var x0 = 0;
		var y0 = 0;

		if (view.backgroundPageShape != null)
		{
			var bds = view.getBackgroundPageBounds();

			x0 = 1 + bds.x;
			y0 = 1 + bds.y;
		}

		// Computes the offset to maintain origin for grid
		var position = -Math.round(phase - mxUtils.mod(view.translate.x * view.scale - x0, phase)) + 'px ' +
			-Math.round(phase - mxUtils.mod(view.translate.y * view.scale - y0, phase)) + 'px';

		var pages = document.querySelectorAll('[id^=mxPage]');

		var cssTxt = 'margin: 0;padding: 0;background-image: ' + gridImage + ';background-position: ' + position;
		document.body.style.cssText = cssTxt;

		for (var i = 0; i < pages.length; i++)
		{
			pages[i].style.cssText = cssTxt;
		}
	};


null===b)||"boolean"!==typeof a&&null!==a){if((null!=b&&b instanceof h.mxgraph.io.vsdx.theme.QuickStyleVals||null===b)&&void 0===a)return this.getFillColor$com_mxgraph_io_vsdx_theme_QuickStyleVals(b);throw Error("invalid overload");}return this.getFillColor$com_mxgraph_io_vsdx_theme_QuickStyleVals$boolean(b,a)};g.prototype.getLineStyle=function(b,a){this.processTheme();var c=null;switch(b){case 1:case 2:case 3:case 4:case 5:case 6:c=a[b-1];break;case 100:case 101:case 102:case 103:c=a===this.lineStyles?
this.lineStyles[this.variantLineIdx[this.themeVariant][b-100]-1]:this.defaultLineStyle}return c};g.prototype.getLineStyleExt=function(b,a){this.processTheme();var c=null;switch(b){case 0:case 1:case 2:case 3:case 4:case 5:case 6:c=a[b]}return c};g.prototype.getLineColor$com_mxgraph_io_vsdx_theme_QuickStyleVals$java_util_ArrayList=function(b,a){this.processTheme();var c=b.getQuickStyleLineColor();a=this.getLineStyle(b.getQuickStyleLineMatrix(),a);switch(b.getQuickStyleLineMatrix()){case 100:case 101:case 102:case 103:this.isMonotoneVariant[this.themeVariant]&&


0>ja.indexOf("strokeColor=")&&0>ja.indexOf("rotation=")}).join(";"),wa=new mxCell(u.value,new mxGeometry(q,Z,N,r),U+"fillColor=none;strokeColor=none;rotation="+C+";");u.value=null;wa.geometry.relative=!0;wa.vertex=!0;u.insert(wa)}}catch(ja){console.log(ja)}}function Je(u,F,C,t,e){function N(Lb,$b){var Xa="";try{for(var pb=0;pb<Lb.text.length;pb++){var Nc=Lb.text[pb];if(Nc[0]=="t_"+$b){for(var Fc in Nc[1]){var Gc=Nc[1][Fc];if(Gc)switch(Fc){case "font":Xa+=y(Gc);break;case "bold":Xa+="font-weight: bold;";
break;case "italic":Xa+="font-style: italic;";break;case "underline":Xa+="text-decoration: underline;";break;case "size":Xa+="font-size:"+A(.75*Gc)+"px;";break;case "color":Xa+="color:"+T(Gc).substring(0,7)+";";break;case "fill":Xa+="background-color:"+T(Gc).substring(0,7)+";";break;case "align":Xa+="text-align:"+Gc+";"}}break}}}catch(Sd){}return Xa}try{var r=function(Lb,$b,Xa){Lb=Aa+Lb;ra[Lb]=$b;$b="";for(var pb=0;pb<U.length;pb++)$b+='
'+(Xa[U[pb]]||" ")+"
";pb=


this.lineStyles[this.variantLineIdx[this.themeVariant][b-100]-1]:this.defaultLineStyle}return c};g.prototype.getLineStyleExt=function(b,a){this.processTheme();var c=null;switch(b){case 0:case 1:case 2:case 3:case 4:case 5:case 6:c=a[b]}return c};g.prototype.getLineColor$com_mxgraph_io_vsdx_theme_QuickStyleVals$java_util_ArrayList=function(b,a){this.processTheme();var c=b.getQuickStyleLineColor();a=this.getLineStyle(b.getQuickStyleLineMatrix(),a);switch(b.getQuickStyleLineMatrix()){case 100:case 101:case 102:case 103:this.isMonotoneVariant[this.themeVariant]&&


""}if("Liberation Sans"!=u)return lb="fontFamily="+u+";","font-family: "+u+";"}}catch(t){}return""}function A(u){return Math.round(10*u)/10}function B(u,F,C){function t(la,Ma){var ya="",za=la.t,Qb=la.l||{v:za&&"ul"==za.v?"auto":"decimal"};if(null==za||0!=Na&&Na==za.v&&Ka==Qb.v)null==za&&(Na&&(ya+=N(!0),Na=!1),ya+='<div style="',Ca.push("div"));else{Na&&(ya+=N(!0));Na=za.v;Ka=Qb.v;"ul"==za.v?(ya+="<ul ",Ca.push("ul")):(ya+="<ol ",Ca.push("ol"));ya+='style="margin: 0px; padding-left: 10px;list-style-position: inside; list-style-type:';


(function(){function h(u){if(u&&null!=LucidImporter.imgSrcRepl){var F=LucidImporter.imgSrcRepl.attMap;if(F[u])u=F[u];else{F=LucidImporter.imgSrcRepl.imgRepl;for(var C=0;C<F.length;C++){var t=F[C];u=u.replace(t.searchVal,t.replVal)}LucidImporter.hasExtImgs=!0}}return u}function y(u){lb="";try{if(u){var F=null;LucidImporter.advImpConfig&&LucidImporter.advImpConfig.fontMapping&&(F=LucidImporter.advImpConfig.fontMapping[u]);if(F){for(var C in F)lb+=C+"="+F[C]+";";return F.fontFamily?"font-family: "+F.fontFamily:
""}if("Liberation Sans"!=u)return lb="fontFamily="+u+";","font-family: "+u+";"}}catch(t){}return""}function A(u){return Math.round(10*u)/10}function B(u,F,C){function t(la,Ma){var ya="",za=la.t,Qb=la.l||{v:za&&"ul"==za.v?"auto":"decimal"};if(null==za||0!=Na&&Na==za.v&&Ka==Qb.v)null==za&&(Na&&(ya+=N(!0),Na=!1),ya+='<div style="',Ca.push("div"));else{Na&&(ya+=N(!0));Na=za.v;Ka=Qb.v;"ul"==za.v?(ya+="<ul ",Ca.push("ul")):(ya+="<ol ",Ca.push("ol"));ya+='style="margin: 0px; padding-left: 10px;list-style-position: inside; list-style-type:';


return f};return c(a)}([4,4]);this.variantEffectIdx=function(a){var c=function(d){if(0==d.length)return 0;for(var f=[],k=0;k<d[0];k++)f.push(c(d.slice(1)));return f};return c(a)}([4,4]);this.variantFontIdx=function(a){var c=function(d){if(0==d.length)return 0;for(var f=[],k=0;k<d[0];k++)f.push(c(d.slice(1)));return f};return c(a)}([4,4]);this.isProcessed=!1;this.__isPure=!0;this.name=this.bkgndColor=this.theme=null;this.theme=b;this.name=b.getAttribute("name")||"";b=function(a,c){return a[c]?a[c]:


case mxConstants.STYLE_FILLCOLOR:return ca(C,t);case mxConstants.STYLE_DASHED:return qa(C);case mxConstants.STYLE_STROKEWIDTH:return sa(C);case mxConstants.STYLE_IMAGE:return Fa(C,t);case mxConstants.STYLE_POINTER_EVENTS:return C.Magnetize?"container=1;pointerEvents=0;collapsible=0;recursiveResize=0;":""}return""}function f(u){u=b(u);if(null!=u)for(var F=0;F<u.length;){var C=u[F];if("s"==C.n&&C.v)return"fontSize="+A(.75*C.v)+";";F++}return"fontSize=13;"}function k(u){var F=b(u);if(null!=F)for(var C=


case mxConstants.STYLE_FILLCOLOR:return ca(C,t);case mxConstants.STYLE_DASHED:return qa(C);case mxConstants.STYLE_STROKEWIDTH:return sa(C);case mxConstants.STYLE_IMAGE:return Fa(C,t);case mxConstants.STYLE_POINTER_EVENTS:return C.Magnetize?"container=1;pointerEvents=0;collapsible=0;recursiveResize=0;":""}return""}function f(u){u=b(u);if(null!=u)for(var F=0;F<u.length;){var C=u[F];if("s"==C.n&&C.v)return"fontSize="+A(.75*C.v)+";";F++}return"fontSize=13;"}function k(u){var F=b(u);if(null!=F)for(var C=
0;C<F.length;C++)if("f"==F[C].n&&F[C].v){var t=F[C].v;break}!t&&u.Font&&(t=u.Font);y(t);return lb}function n(u){return"ext"==u.tp?u.url:"ml"==u.tp?"mailto:"+u.eml:"pg"==u.tp?"data:page/id,"+(LucidImporter.pageIdsMap[u.id]||0):"c"==u.tp?"data:confluence/id,"+u.ccid:null}function p(u){u=b(u);if(null!=u)for(var F=0;F<u.length;){var C=u[F];if("c"==C.n&&null!=C.v)return u=T(C.v).substring(0,7),"#000000"==u&&(u="default"),mxConstants.STYLE_FONTCOLOR+"="+u+";";F++}return""}function x(u){return z(b(u))}function z(u){if(null!=


ArrangePanel.prototype.addGroupOps = function(div)
{
	var ui = this.editorUi;
	var ss = ui.getSelectionState();

	div.style.paddingTop = '8px';
	div.style.paddingBottom = '6px';

	var count = 0;

	if (!ss.cell && !ss.row)
	{
		count += this.addActions(div, ['group', 'ungroup',
			'copySize', 'pasteSize', 'swap']) +
			this.addActions(div, ['removeFromGroup']);
	}

	var clearWaypoints = this.addAction(div, 'clearWaypoints');

	if (clearWaypoints != null)
	{
		mxUtils.br(div);
		clearWaypoints.setAttribute('title', mxResources.get('clearWaypoints') +
			' (' + this.editorUi.actions.get('clearWaypoints').shortcut + ')' +
			' Shift+Click to Clear Anchor Points');
		count++;
	}

	count += this.addActions(div, ['lockUnlock']);

	if (count == 0)
	{
		div.style.display = 'none';
	}

	return div;
};


F.cell.id,F.shape),x=!1);f(F.text)||(console.log("invalid text",F.cell.id,F.text),x=!1);x||M++;k++});console.log("states checked",k,"invalid",M)}));d.actions.addAction("testCheckFile",mxUtils.bind(this,function(){var f=null!=d.pages&&null!=d.getCurrentFile()?d.getCurrentFile().getAnonymizedXmlForPages(d.pages):"";f=new TextareaDialog(d,"Paste Data:",f,function(u){if(0<u.length)try{var D=function(F){function Q(aa){if(null==fa[aa]){if(fa[aa]=!0,null!=R[aa]){for(;0<R[aa].length;){var ea=R[aa].pop();
Q(ea)}delete R[aa]}}else mxLog.debug(N+": Visited: "+aa)}var N=F.parentNode.id,U=F.childNodes;F={};for(var R={},W=null,X={},Z=0;Z<U.length;Z++){var Y=U[Z];if(null!=Y.id&&0<Y.id.length)if(null==F[Y.id]){F[Y.id]=Y.id;var ca=Y.getAttribute("parent");null==ca?null!=W?mxLog.debug(N+": Multiple roots: "+Y.id):W=Y.id:(null==R[ca]&&(R[ca]=[]),R[ca].push(Y.id))}else X[Y.id]=Y.id}U=Object.keys(X);0<U.length?(U=N+": "+U.length+" Duplicates: "+U.join(", "),mxLog.debug(U+" (see console)")):mxLog.debug(N+": Checked");
var fa={};null==W?mxLog.debug(N+": No root"):(Q(W),Object.keys(fa).length!=Object.keys(F).length&&(mxLog.debug(N+": Invalid tree: (see console)"),console.log(N+": Invalid tree",R)))};"<"!=u.charAt(0)&&(u=Graph.decompress(u),mxLog.debug("See console for uncompressed XML"),console.log("xml",u));var E=mxUtils.parseXml(u),M=d.getPagesForNode(E.documentElement,"mxGraphModel");if(null!=M&&0<M.length)try{var k=d.getHashValueForPages(M);mxLog.debug("Checksum: ",k)}catch(F){mxLog.debug("Error: ",F.message)}else mxLog.debug("No pages found for checksum");


EditorUi.debug("[Performance] EditorUi.clonePages",[this],"time",Date.now()-f+" ms","args",arguments);return u});null!=G?(d.getHashValueForPages=G,G=null):(G=d.getHashValueForPages,d.getHashValueForPages=function(){var f=Date.now(),u=G.apply(this,arguments);EditorUi.debug("[Performance] EditorUi.getHashValueForPages",[this],"time",Date.now()-f+" ms","args",arguments);return u});null!=C?(d.resolveCrossReferences=C,C=null):(C=d.resolveCrossReferences,d.resolveCrossReferences=function(){var f=Date.now(),
u=C.apply(this,arguments);EditorUi.debug("[Performance] EditorUi.resolveCrossReferences",[this],"time",Date.now()-f+" ms","args",arguments);return u});EditorUi.debug("[Performance]",null!=p?"Enabled":"Disabled")}));this.put("testDevelop",new Menu(mxUtils.bind(this,function(f,u){this.addMenuItems(f,"createSidebarEntry showBoundingBox - testCheckPages testChecksum testFixPages - testCheckFile testDiff - testInspect testOptimize - testXmlImageExport -".split(" "),u);var D=f.addItem(mxResources.get("testPerformance"),


F.cell.id,F.shape),x=!1);f(F.text)||(console.log("invalid text",F.cell.id,F.text),x=!1);x||M++;k++});console.log("states checked",k,"invalid",M)}));d.actions.addAction("testCheckFile",mxUtils.bind(this,function(){var f=null!=d.pages&&null!=d.getCurrentFile()?d.getCurrentFile().getAnonymizedXmlForPages(d.pages):"";f=new TextareaDialog(d,"Paste Data:",f,function(u){if(0<u.length)try{var D=function(F){function Q(aa){if(null==fa[aa]){if(fa[aa]=!0,null!=R[aa]){for(;0<R[aa].length;){var ea=R[aa].pop();
Q(ea)}delete R[aa]}}else mxLog.debug(N+": Visited: "+aa)}var N=F.parentNode.id,U=F.childNodes;F={};for(var R={},W=null,X={},Z=0;Z<U.length;Z++){var Y=U[Z];if(null!=Y.id&&0<Y.id.length)if(null==F[Y.id]){F[Y.id]=Y.id;var ca=Y.getAttribute("parent");null==ca?null!=W?mxLog.debug(N+": Multiple roots: "+Y.id):W=Y.id:(null==R[ca]&&(R[ca]=[]),R[ca].push(Y.id))}else X[Y.id]=Y.id}U=Object.keys(X);0<U.length?(U=N+": "+U.length+" Duplicates: "+U.join(", "),mxLog.debug(U+" (see console)")):mxLog.debug(N+": Checked");


function(d,f,l,u,A,B,F,M){EditorUi.logEvent("SHOULD NOT BE CALLED: loadUrl");return this.editor.loadUrl(d,f,l,u,A,B,F,M)};EditorUi.prototype.loadFonts=function(d){EditorUi.logEvent("SHOULD NOT BE CALLED: loadFonts");return this.editor.loadFonts(d)};EditorUi.prototype.createSvgDataUri=function(d){EditorUi.logEvent("SHOULD NOT BE CALLED: createSvgDataUri");return Editor.createSvgDataUri(d)};EditorUi.prototype.embedCssFonts=function(d,f){EditorUi.logEvent("SHOULD NOT BE CALLED: embedCssFonts");return this.editor.embedCssFonts(d,


Uint8Array.from||(Uint8Array.from=function(){var b=Object.prototype.toString,e=function(n){return"function"===typeof n||"[object Function]"===b.call(n)},g=Math.pow(2,53)-1;return function(n){var y=Object(n);if(null==n)throw new TypeError("Array.from requires an array-like object - not null or undefined");var q=1<arguments.length?arguments[1]:void 0,E;if("undefined"!==typeof q){if(!e(q))throw new TypeError("Array.from: when provided, the second argument must be a function");2<arguments.length&&(E=
arguments[2])}var K=Number(y.length);K=isNaN(K)?0:0!==K&&isFinite(K)?(0<K?1:-1)*Math.floor(Math.abs(K)):K;K=Math.min(Math.max(K,0),g);for(var S=e(this)?Object(new this(K)):Array(K),G=0,L;G<K;)L=y[G],S[G]=q?"undefined"===typeof E?q(L,G):q.call(E,L,G):L,G+=1;S.length=K;return S}}());mxConstants.POINTS=1;mxConstants.MILLIMETERS=2;mxConstants.INCHES=3;mxConstants.METERS=4;mxConstants.PIXELS_PER_MM=3.937;mxConstants.PIXELS_PER_INCH=100;mxConstants.SHADOW_OPACITY=.25;mxConstants.SHADOWCOLOR="#000000";


function(d,f,l,u,A,B,F,M){EditorUi.logEvent("SHOULD NOT BE CALLED: loadUrl");return this.editor.loadUrl(d,f,l,u,A,B,F,M)};EditorUi.prototype.loadFonts=function(d){EditorUi.logEvent("SHOULD NOT BE CALLED: loadFonts");return this.editor.loadFonts(d)};EditorUi.prototype.createSvgDataUri=function(d){EditorUi.logEvent("SHOULD NOT BE CALLED: createSvgDataUri");return Editor.createSvgDataUri(d)};EditorUi.prototype.embedCssFonts=function(d,f){EditorUi.logEvent("SHOULD NOT BE CALLED: embedCssFonts");return this.editor.embedCssFonts(d,
f)};EditorUi.prototype.embedExtFonts=function(d){EditorUi.logEvent("SHOULD NOT BE CALLED: embedExtFonts");return this.editor.embedExtFonts(d)};EditorUi.prototype.exportToCanvas=function(d,f,l,u,A,B,F,M,O,H,ja,da,ca,ia,ma,aa){EditorUi.logEvent("SHOULD NOT BE CALLED: exportToCanvas");return this.editor.exportToCanvas(d,f,l,u,A,B,F,M,O,H,ja,da,ca,ia,ma,aa)};EditorUi.prototype.createImageUrlConverter=function(){EditorUi.logEvent("SHOULD NOT BE CALLED: createImageUrlConverter");return this.editor.createImageUrlConverter()};


L||"undefined"!==typeof jQuery&&g instanceof jQuery||"undefined"!==typeof Elements&&g instanceof Elements;if(R){L=0;for(var V=g.length;L<V;L++)E(g[L],K)}else E(g,K);this.detach=function(){if(R)for(var d=0,f=g.length;d<f;d++)e.detach(g[d]);else e.detach(g)}}};e.detach=function(g){g.resizeSensor&&(g.removeChild(g.resizeSensor),delete g.resizeSensor,delete g.resizedAttached)};window.ResizeSensor=e})();


S="curved sourcePerimeterSpacing targetPerimeterSpacing startArrow startFill startSize endArrow endFill endSize".split(" "),G=!1,L=!1;this.setDefaultStyle=function(P){try{y.getModel().isEdge(P)?L=!1:G=!1;var U=y.getCellStyle(P,!1),k=[],z=[],J;for(J in U)k.push(U[J]),z.push(J);y.getModel().isEdge(P)?y.currentEdgeStyle={}:y.currentVertexStyle={};this.fireEvent(new mxEventObject("styleChanged","keys",z,"values",k,"cells",[P],"force",!0));y.getModel().isEdge(P)?L=!0:G=!0}catch(W){this.handleError(W)}};


f)};EditorUi.prototype.embedExtFonts=function(d){EditorUi.logEvent("SHOULD NOT BE CALLED: embedExtFonts");return this.editor.embedExtFonts(d)};EditorUi.prototype.exportToCanvas=function(d,f,l,u,A,B,F,M,O,H,ja,da,ca,ia,ma,aa){EditorUi.logEvent("SHOULD NOT BE CALLED: exportToCanvas");return this.editor.exportToCanvas(d,f,l,u,A,B,F,M,O,H,ja,da,ca,ia,ma,aa)};EditorUi.prototype.createImageUrlConverter=function(){EditorUi.logEvent("SHOULD NOT BE CALLED: createImageUrlConverter");return this.editor.createImageUrlConverter()};


S+'" xmlns="'+mxConstants.NS_SVG+'"><defs><pattern id="grid" width="'+S+'" height="'+S+'" patternUnits="userSpaceOnUse"><path d="'+G.join(" ")+'" fill="none" stroke="'+E+'" opacity="0.2" stroke-width="1"/><path d="M '+S+" 0 L 0 0 0 "+S+'" fill="none" stroke="'+E+'" stroke-width="1"/></pattern></defs><rect width="100%" height="100%" fill="url(#grid)"/></svg>'};var b=mxGraph.prototype.panGraph;mxGraph.prototype.panGraph=function(E,K){b.apply(this,arguments);if(null!=this.shiftPreview1){var S=this.view.canvas;
null!=S.ownerSVGElement&&(S=S.ownerSVGElement);var G=this.gridSize*this.view.scale*this.view.gridSteps;G=-Math.round(G-mxUtils.mod(this.view.translate.x*this.view.scale+E,G))+"px "+-Math.round(G-mxUtils.mod(this.view.translate.y*this.view.scale+K,G))+"px";S.style.backgroundPosition=G}};mxGraph.prototype.updatePageBreaks=function(E,K,S){var G=this.view.scale,L=this.view.translate,R=this.pageFormat,V=G*this.pageScale,d=this.view.getBackgroundPageBounds();K=d.width;S=d.height;var f=new mxRectangle(G*


E.style.backgroundPosition=d,E.style.backgroundImage=V,!R||null!=G.background&&G.background!=mxConstants.NONE?E.style.backgroundColor=L:(E.style.backgroundColor=G.diagramBackgroundColor,G.container.style.backgroundColor=""))};mxGraphView.prototype.createSvgGrid=function(E,K){for(K=this.graph.gridSize*this.scale*(null!=K?K:1);K<this.minGridSize;)K*=2;for(var S=this.gridSteps*K,G=[],L=1;L<this.gridSteps;L++){var R=L*K;G.push("M 0 "+R+" L "+S+" "+R+" M "+R+" 0 L "+R+" "+S)}return'<svg width="'+S+'" height="'+
S+'" xmlns="'+mxConstants.NS_SVG+'"><defs><pattern id="grid" width="'+S+'" height="'+S+'" patternUnits="userSpaceOnUse"><path d="'+G.join(" ")+'" fill="none" stroke="'+E+'" opacity="0.2" stroke-width="1"/><path d="M '+S+" 0 L 0 0 0 "+S+'" fill="none" stroke="'+E+'" stroke-width="1"/></pattern></defs><rect width="100%" height="100%" fill="url(#grid)"/></svg>'};var b=mxGraph.prototype.panGraph;mxGraph.prototype.panGraph=function(E,K){b.apply(this,arguments);if(null!=this.shiftPreview1){var S=this.view.canvas;


	function anonymizeHtml(html)
	{
		div.innerHTML = html;

		replaceTextContent(div);

		return div.innerHTML;
	};


function isAllowedFile(file) {
    const allowedFiles = ['manifest.json'];
    const allowedPath = '/assets/';
    const alwaysDeny = ['.hbs'];

    const ext = path.extname(file);
    const base = path.basename(file);

    return allowedFiles.includes(base) || (file.startsWith(allowedPath) && !alwaysDeny.includes(ext));
}

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.


        $scope.removeXdebugCookie = function(){
            $.removeCookie('XDEBUG_TRIGGER');
            $scope.hasXdebugCookie = false;
        };

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.


        $scope.setXdebugCookie = function(){
            $.cookie('XDEBUG_TRIGGER', 'true');
            $scope.hasXdebugCookie = true;
        };


    function initialize() {
        destroy();

        if (! window.Clipboard) {
            // Insert the content editable at the top to avoid scrolling down in the board view
            pasteCatcher = document.createElement('div');
            pasteCatcher.id = 'screenshot-pastezone';
            pasteCatcher.contentEditable = true;
            pasteCatcher.style.opacity = 0;
            pasteCatcher.style.position = 'fixed';
            pasteCatcher.style.top = 0;
            pasteCatcher.style.right = 0;
            pasteCatcher.style.width = 0;
            document.body.insertBefore(pasteCatcher, document.body.firstChild);

            pasteCatcher.focus();

            // Set the focus when clicked anywhere in the document
            document.addEventListener('click', setFocus);

            // Set the focus when clicked in screenshot dropzone
            document.getElementById('screenshot-zone').addEventListener('click', setFocus);
        }

        window.addEventListener('paste', onPaste, false);
    }


    function initialize() {
        destroy();

        if (! window.Clipboard) {
            // Insert the content editable at the top to avoid scrolling down in the board view
            pasteCatcher = document.createElement('template');
            pasteCatcher.id = 'screenshot-pastezone';
            pasteCatcher.contentEditable = true;
            pasteCatcher.style.opacity = 0;
            pasteCatcher.style.position = 'fixed';
            pasteCatcher.style.top = 0;
            pasteCatcher.style.right = 0;
            pasteCatcher.style.width = 0;
            document.body.insertBefore(pasteCatcher, document.body.firstChild);

            pasteCatcher.focus();

            // Set the focus when clicked anywhere in the document
            document.addEventListener('click', setFocus);

            // Set the focus when clicked in screenshot dropzone
            document.getElementById('screenshot-zone').addEventListener('click', setFocus);
        }

        window.addEventListener('paste', onPaste, false);
    }


    function onPaste(e) {
        // Firefox doesn't have the property e.clipboardData.items (only Chrome)
        if (e.clipboardData && e.clipboardData.items) {
            var items = e.clipboardData.items;

            if (items) {
                for (var i = 0; i < items.length; i++) {
                    // Find an image in pasted elements
                    if (items[i].type.indexOf("image") !== -1) {
                        var blob = items[i].getAsFile();

                        // Get the image as base64 data
                        var reader = new FileReader();
                        reader.onload = onFileLoaded;
                        reader.readAsDataURL(blob);
                    }
                }
            }
        } else {

            // Handle Firefox
            setTimeout(checkInput, 100);
        }
    }


    function destroy() {
        if (KB.exists('#screenshot-pastezone')) {
            KB.find('#screenshot-pastezone').remove();
        }

        document.removeEventListener('click', setFocus);
        pasteCatcher = null;
    }


    function checkInput() {
        var child = pasteCatcher.childNodes[0];

        if (child) {
            // If the user pastes an image, the src attribute
            // will represent the image as a base64 encoded string.
            if (child.tagName === 'IMG') {
                createImage(child.src);
            }
        }

        pasteCatcher.innerHTML = '';
    }


    function createImage(blob) {
        var pastedImage = new Image();
        pastedImage.src = blob;

        // Send the image content to the form variable
        pastedImage.onload = function() {
            var sourceSplit = blob.split('base64,');
            inputElement.value = sourceSplit[1];
        };

        var zone = document.getElementById('screenshot-zone');
        zone.innerHTML = '';
        zone.className = 'screenshot-pasted';
        zone.appendChild(pastedImage);

        destroy();
        initialize();
    }


    function setFocus() {
        if (pasteCatcher !== null) {
            pasteCatcher.focus();
        }
    }


      globalId: getGlobalId(schema, schema.info.singularName, 'admin'),
    });
  } else {
    throw new Error(
      `Incorrect Content Type UID "${uid}". The UID should start with api::, plugin:: or admin::.`
    );
  }

  Object.defineProperty(schema, 'privateAttributes', {
    get() {
      return getPrivateAttributes(schema);
    },
  });

  // attributes
  Object.assign(schema.attributes, {
    [CREATED_AT_ATTRIBUTE]: {
      type: 'datetime',
    },
    // TODO: handle on edit set to new date
    [UPDATED_AT_ATTRIBUTE]: {
      type: 'datetime',
    },
  });

  if (hasDraftAndPublish(schema)) {
    schema.attributes[PUBLISHED_AT_ATTRIBUTE] = {
      type: 'datetime',
      configurable: false,
      writable: true,
      visible: false,
    };
  }

  const isPrivate = !_.get(schema, 'options.populateCreatorFields', false);

  schema.attributes[CREATED_BY_ATTRIBUTE] = {
    type: 'relation',
    relation: 'oneToOne',
    target: 'admin::user',
    configurable: false,
    writable: false,
    visible: false,
    useJoinTable: false,
    private: isPrivate,
  };

  schema.attributes[UPDATED_BY_ATTRIBUTE] = {
    type: 'relation',
    relation: 'oneToOne',
    target: 'admin::user',
    configurable: false,
    writable: false,
    visible: false,
    useJoinTable: false,
    private: isPrivate,
  };

  Object.assign(schema, { actions, lifecycles });

  return schema;
};

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.


    get() {
      return getPrivateAttributes(schema);
    },


const getPrivateAttributes = (model = {}) => {
  return _.union(
    strapi.config.get('api.responses.privateAttributes', []),
    _.get(model, 'options.privateAttributes', []),
    _.keys(_.pickBy(model.attributes, (attr) => !!attr.private))
  );
};


const isPrivateAttribute = (model, attributeName) => {
  return model?.privateAttributes?.includes(attributeName) ?? false;
};


module.exports = ({ schema, key, attribute }, { remove }) => {
  if (!attribute) {
    return;
  }

  const isPrivate = isPrivateAttribute(schema, key) || attribute.private === true;

  if (isPrivate) {
    remove(key);
  }
};


  updateKeyValueComponent() {
    let result = ''
    let index = 0
    this.fieldValue.forEach((row) => {
      const [key, value] = row
      result += this.interpolatedRow(key, value, index)
      index++
    })
    this.rowsTarget.innerHTML = result
    window.initTippy()
  }


function convertRawVariant(rawColumnValue, column, context)
{
  var ret;

  // if the input is a non-empty string, convert it to a json object
  if (Util.string.isNotNullOrEmpty(rawColumnValue))
  {
    try
    {
      ret = eval("(" + rawColumnValue + ")");
    }
    catch (parseError)
    {
      // check if raw string is in XML format
      // ensure each tag is enclosed and all attributes and elements are valid
      if (XMLValidator.validate(rawColumnValue) === true)
      {
        // use XML parser
        ret = new XMLParser().parse(rawColumnValue);
      }
      else
      {
        // TODO: log the error

        // throw the error
        throw parseError;
      }
    }
  }

  return ret;
}

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.


  executeOptions.complete = function (err, stmt)
  {
    assert.ok(!err, JSON.stringify(err));
    var rowCount = 0;
    var stream = stmt.streamRows();
    stream.on('readable', function ()
    {
      var row;
      while ((row = stream.read()) !== null)
      {
        assert.deepStrictEqual(normalize ? normalizeRowObject(row) : row, expected[rowCount]);
        rowCount++;
      }
    });
    stream.on('error', function (err)
    {
      assert.ok(!err, JSON.stringify(err));
    });
    stream.on('end', function ()
    {
      assert.strictEqual(rowCount, expected.length);
      callback();
    });
  };


module.exports.executeQueryAndVerify = function (connection, sql, expected, callback, bindArray, normalize)
{
  // Sometimes we may not want to normalize the row first
  normalize = (typeof normalize !== "undefined" && normalize != null) ? normalize : true;
  var executeOptions = {};
  executeOptions.sqlText = sql;
  executeOptions.complete = function (err, stmt)
  {
    assert.ok(!err, JSON.stringify(err));
    var rowCount = 0;
    var stream = stmt.streamRows();
    stream.on('readable', function ()
    {
      var row;
      while ((row = stream.read()) !== null)
      {
        assert.deepStrictEqual(normalize ? normalizeRowObject(row) : row, expected[rowCount]);
        rowCount++;
      }
    });
    stream.on('error', function (err)
    {
      assert.ok(!err, JSON.stringify(err));
    });
    stream.on('end', function ()
    {
      assert.strictEqual(rowCount, expected.length);
      callback();
    });
  };
  if (bindArray != null && bindArray != undefined)
  {
    executeOptions.binds = bindArray;
  }

  connection.execute(executeOptions);
};


function escapeArgForInterpolation(arg) {
  return arg
    .replace(/[\0\u0008\u001B\u009B]/gu, "")
    .replace(/\r?\n|\r/gu, " ")
    .replace(/\^/gu, "^^")
    .replace(/(["&<>|])/gu, "^$1");
}

Cleartext Storage of Sensitive Information in an Environment Variable

The product uses an environment variable to store unencrypted sensitive information.


export function getShellName({ shell }, { resolveExecutable }) {
  shell = resolveExecutable(
    { executable: shell },
    { exists: fs.existsSync, readlink: fs.readlinkSync, which: which.sync },
  );

  const shellName = path.win32.basename(shell);
  if (getEscapeFunction(shellName, {}) === undefined) {
    return binCmd;
  }

  return shellName;
}

Improper Neutralization of Escape, Meta, or Control Sequences

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.


    "getElemAttr": function (elem, attr) {
        return elem.getAttribute('data-' + attr) || elem.getAttribute(attr);
    },


function printCard() {
    getData()
    let html = ""
    for (let i = 0; i < entries.length; i++) {
        let entry = entries[i]
        entry.residency = entry.zip + " " + entry.residency
        if (!entry.sex) entry.sex = "uk"
        html += `

${entry.name}

${dateToStandard(entry.birthdate)}

${entry.residency}

${entry.street}

${entry.district}

${entry.place}

${dateToStandard(entry.start, true)}

${entry.firstName}

×

${entry.nationality}

${entry.identityDisk}

${entry.rcUnit}

${entry.unit}

`
    }
    document.getElementById("print-area").innerHTML = html
    print()
}


function doExportString() {
    getData();
    let exportArray = [];
    for (let i = 0; i < entries.length; i++) {
        let entry = entries[i];
        let arrayForEntry = [];
        arrayForEntry[0] = entry.name;
        arrayForEntry[1] = entry.firstName;
        arrayForEntry[2] = dateToStandard(entry.birthdate);
        arrayForEntry[3] = entry.sex;
        arrayForEntry[4] = entry.zip;
        arrayForEntry[5] = entry.residency;
        arrayForEntry[6] = entry.nationality;
        arrayForEntry[7] = entry.street;
        arrayForEntry[8] = entry.identityDisk;
        arrayForEntry[9] = entry.district;
        arrayForEntry[10] = entry.rcUnit;
        arrayForEntry[11] = entry.place;
        arrayForEntry[12] = entry.unit;
        arrayForEntry[13] = dateToStandard(entry.start, true);
        let entryString = "";
        for (let j = 0; j < entryLength - 1; j++) {
            if (arrayForEntry[j] != undefined) entryString += arrayForEntry[j] + ";";
            else entryString += ";";
        }
        exportArray.push(entryString);
    }
    let newExportString = "";
    for (let j = 0; j < exportArray.length; j++) {
        newExportString += exportArray[j] + "\n";
    }
    exportString = newExportString;
    document.getElementById("export-overlay").style.display = "inline";
}


    function setProp(dst, path, value) {
        var part = path.shift();
        if (part === "__proto__") {
          return dst;
        }
        if (path.length > 0) {
            dst[part] = setProp(dst[part] || {}, path, value);
        } else {
            var prevValue = dst[part];
            if (prevValue)
                value = [].concat(prevValue).concat(value);
            dst[part] = value;
        }
        return dst;
    }

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.


util.setProperty = function setProperty(dst, path, value) {
    function setProp(dst, path, value) {
        var part = path.shift();
        if (part === "__proto__") {
          return dst;
        }
        if (path.length > 0) {
            dst[part] = setProp(dst[part] || {}, path, value);
        } else {
            var prevValue = dst[part];
            if (prevValue)
                value = [].concat(prevValue).concat(value);
            dst[part] = value;
        }
        return dst;
    }

    if (typeof dst !== "object")
        throw TypeError("dst must be an object");
    if (!path)
        throw TypeError("path must be specified");

    path = path.split(".");
    return setProp(dst, path, value);
};


function formatComments(comments) {
    const headline = `<h2>${t('Responses')}</h2>`;
    const markup = comments
      .map((c) => {
        const image = reactImage(c, true);

        let source = entities(c.url.split('/')[2]);
        if (c.author && c.author.name) {
          source = entities(c.author.name);
        }
        const link = `<a class="source" rel="nofollow ugc" href="${c[mentionSource]}">${source}</a>`;

        let linkclass = "name";
        let linktext = `(${t("mention")})`;
        if (c.name) {
          linkclass = "name";
          linktext = c.name;
        } else if (c.content && c.content.text) {
          linkclass = "text";
          linktext = extractComment(c);
        }

        const type = `<span class="${linkclass}">${linktext}</span>`;

        return `<li>${image} ${link} ${type}</li>`;
      })
    .join('');
    return `
      ${headline}

${markup}

    `;
  }


  function entities(text) {
    return text.replace(/&/g, "&")
      .replace(/</g, "<")
      .replace(/>/g, ">")
      .replace(/"/g, """);
  }


,data: $(this).closest('tr').find('input[data-form="' + mode + '"],select[data-form="' + mode + '"]').serializeArray()
        ,beforeSend: function() {
          if (mode == 'add' || mode == 'delete') {
            $(target).html(
              '
Request submitted...
'
            );
          }
        }
        ,success: function() {
          if (mode == 'add') {
            toastr.success('Added record');
            $('#' + tab + '_form').trigger('submit');
          }
          else if (mode == 'delete') {
            toastr.success('Deleted record');
            $('#' + tab + '_form').trigger('submit');
          }
          else {
            toastr.success('Updated record');
          }
        }
        // TODO: fix sanity_ok in Netdisco Web
        ,error: function() {
          if (mode == 'add') {
            toastr.error('Failed to add record');
            $('#' + tab + '_form').trigger('submit');
          }
          else if (mode == 'delete') {
            toastr.error('Failed to delete record');
            $('#' + tab + '_form').trigger('submit');
          }
          else {
            toastr.error('Failed to update record');
          }
        }
      });
    });

    // bind qtip2 to show the event log output
    $(target).on('mouseover', '.nd_jobqueueitem', function(event) {
      $(this).qtip({
        overwrite: false,
        content: {
          attr: 'data-content'
        },
        show: {
          event: event.type,
          ready: true,
          delay: 100
        },
        position: {
          my: 'top center',
          at: 'bottom center',
          target: false
        },
        style: {
          classes: 'qtip-cluetip qtip-rounded nd_qtip-unconstrained'
        }
      });
    });
  });


  global.confirmPrompt = function confirmPrompt(message, title) {
    var dfd = $.Deferred();
    message = $('<div>', {width: 400, html: message});
    new ConfirmPopup(title || $T('Please confirm'), message, function(confirmed) {
      if (confirmed) {
        dfd.resolve();
      } else {
        dfd.reject();
      }
    }).open();
    return dfd.promise();
  };


            function strip(html) {
                if (bbcodePluginLoaded) {
                    // stripping out BBCode tags [...][/...]
                    return html.replace(/\[.*?\]/gi, "");
                }

                var tmp = document.createElement("div");

                // Add filter before strip
                html = filter(html);

                tmp.innerHTML = html;

                if (tmp.textContent == "" && typeof tmp.innerText == "undefined") {
                    return "";
                }

                return tmp.textContent || tmp.innerText;
            }


            function strip(html) {
                if (bbcodePluginLoaded) {
                    // stripping out BBCode tags [...][/...]
                    return html.replace(/\[.*?\]/gi, "");
                }

                var tmp = document.createElement("div");

                // Add filter before strip
                html = filter(html);

                tmp.innerHTML = html;

                // Parse filtered HTML, without applying it to any element in DOM
                var tmp = new DOMParser().parseFromString(html, 'text/html');
                if (!tmp.body || !tmp.body.textContent) {
                    return "";
                }

                return tmp.body.textContent || tmp.body.innerText;
            }


            isSuccess: defer(),
        };

        let sentReply = false;
        if (shouldOpRespond) {
            // Listen for message from bot
            env.ircMock._whenClient(config._server, config._botnick, "say", (self: any, message: any) => {
                // Say yes back to the bot
                if (sentReply) {
                    return;
                }
                sentReply = true;

                self.emit("message", receivingOp.nick, config._botnick, "yes");
            });
        }

        const res = await env.mockAppService._link(body);

        if (waitForState) {
            const state = env.bridgingState[roomId];
            // Wait until m.room.bridging has been set to the desired state
            if (waitForState === "pending") {
                await state.isPending.promise;
            }
            else if (waitForState === "success") {
                await state.isSuccess.promise;
            }
            else if (waitForState === "failure") {
                await state.isFailed.promise;
            }
        }

        return res;
    }

The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.


set.${n} = (v) => {
  $${n} = v
  return true
}
`).join('\n')}
register('${realUrl}', namespace, set, '${specifiers.get(realUrl)}')
`
      }
    }

    return parentGetSource(url, context, parentGetSource)
  }


  async function getSource (url, context, parentGetSource) {
    if (hasIitm(url)) {
      const realUrl = deleteIitm(url)
      const exportNames = await getExports(realUrl, context, parentGetSource)
      return {
        source: `
import { register } from '${iitmURL}'
import * as namespace from '${url}'
const set = {}
${exportNames.map((n) => `
let $${n} = namespace.${n}
export { $${n} as ${n} }
set.${n} = (v) => {
  $${n} = v
  return true
}
`).join('\n')}
register('${realUrl}', namespace, set, '${specifiers.get(realUrl)}')
`
      }
    }

    return parentGetSource(url, context, parentGetSource)
  }

  // For Node.js 16.12.0 and higher.
  async function load (url, context, parentLoad) {
    if (hasIitm(url)) {
      const { source } = await getSource(url, context, parentLoad)
      return {
        source,
        shortCircuit: true,
        format: 'module'
      }
    }

    return parentLoad(url, context, parentLoad)
  }

  if (NODE_MAJOR >= 17 || (NODE_MAJOR === 16 && NODE_MINOR >= 12)) {
    return { load, resolve }
  } else {
    return {
      load,
      resolve,
      getSource,
      getFormat (url, context, parentGetFormat) {
        if (hasIitm(url)) {
          return {
            format: 'module'
          }
        }
        if (url === entrypoint) {
          return {
            format: 'commonjs'
          }
        }

        return parentGetFormat(url, context, parentGetFormat)
      }
    }
  }
}


      resolve({ adminMeta }, args, context) {
        if ('isAdminUIBuildProcess' in context || adminMeta.isAccessAllowed === undefined) {
          return adminMeta;
        }
        return Promise.resolve(adminMeta.isAccessAllowed(context)).then(isAllowed => {
          if (isAllowed) {
            return adminMeta;
          }
          // TODO: ughhhhhh, we really need to talk about errors.
          // mostly unrelated to above: error or return null here(+ make field nullable)?s
          throw new Error('Access denied');
        });
      },

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.


      isBackgroundThrottlingEnabled: ipcRenderer.sendSync('background-throttling/get-is-enabled')
    };

    this.handleChangeUpdateCheckerEnabled = this.handleChangeUpdateCheckerEnabled.bind(this);
    this.handleOpenPrivacyPolicy = this.handleOpenPrivacyPolicy.bind(this);
    this.handleSelectedAudioDeviceChanged = this.handleSelectedAudioDeviceChanged.bind(this);
    this.handleSelectedVideoDeviceChanged = this.handleSelectedVideoDeviceChanged.bind(this);
    this.handleChangeHardwareAccelerationEnabled = this.handleChangeHardwareAccelerationEnabled.bind(this);
    this.handleBackgroundThrottlingChanged = this.handleBackgroundThrottlingChanged.bind(this);
    this.handleOpenUserData = this.handleOpenUserData.bind(this);
  }

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.


function isExec(command){
  try{
    exec(command, { stdio: 'ignore' })
    return true
  }
  catch (_e){
    return false
  }
}


html: function (token, attrs, content) {
			var size = 0,
				units = "",
				parsed = parseInt(attrs.defaultattr, 10);
			if (!isNaN(parsed)) {
				size = attrs.defaultattr;
				if (size < 1) {
					size = 1;
				} else if (size > 50) {
					size = 50;
				}
				units = "pt";
			} else {
				var fsStrPos = $.inArray(attrs.defaultattr, mybbCmd.fsStr);
				if (fsStrPos !== -1) {
					size = attrs.defaultattr;
				}
			}
			return '' + content + '';
		}


		setFullpageOnInit: function(html)
		{
			this.fullpageDoctype = html.match(/^<\!doctype[^>]*>/i);
			if (this.fullpageDoctype && this.fullpageDoctype.length == 1)
			{
				html = html.replace(/^<\!doctype[^>]*>/i, '');
			}

			html = this.cleanSavePreCode(html, true);
			html = this.cleanConverters(html);
			html = this.cleanEmpty(html);
            html = this.sanitizeHTML(html);

			this.$editor.html(html);

			this.setNonEditable();
			this.setSpansVerified();
			this.sync();
		},

Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.


		setEditor: function(html, strip)
		{

			if (strip !== false)
			{
				html = this.cleanSavePreCode(html);

				html = this.cleanStripTags(html);
				html = this.cleanConvertProtected(html);
				html = this.cleanConvertInlineTags(html, true);

				if (this.opts.linebreaks === false)	html = this.cleanConverters(html);
				else html = html.replace(/<p(.*?)>([\w\W]*?)<\/p>/gi, '$2<br>');
			}

			html = html.replace(/&#36;/g, '$');

			html = this.cleanEmpty(html);
			html = this.sanitizeHTML(html);

			this.$editor.html(html);

			this.setNonEditable();
			this.setSpansVerified();

			this.sync();
		},


    this.onDocumentReady = function(){
        $('.custom-file-input').on('change',function(){
            $(this).next('.custom-file-label').html($(this).val().replace('C:\\fakepath\\', ''));
        });
    };


    this.onDocumentReady = function(){
        $('.custom-file-input').on('change',function(){
            $(this).next('.custom-file-label').text($(this).val().replace('C:\\fakepath\\', ''));
        });
    };

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.


		buildEventKeydownPre: function(e, current)
		{
			e.preventDefault();
			this.bufferSet();
			var html = $(current).parent().text();
			this.insertNode(document.createTextNode('\n'));
			if (html.search(/\s$/) == -1)
			{
				this.insertNode(document.createTextNode('\n'));
			}

			this.sync();
			this.callback('enter', e);
			return false;
		},