Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxConstants.STYLE_STROKECOLOR,mxUtils.getValue(C,mxConstants.STYLE_STROKECOLOR,"#000"));"default"==C&&(C=b.shapeForegroundColor);return C};this.createStyle=function(C){var J=";fillColor=none;";v&&(J=";lineShape=1;");return mxConstants.STYLE_SHAPE+"="+C+J};this.stopDrawing=function(){if(0<k.length){if(v){for(var C=[],J=0;J<x.length;J++)null!=x[J]&&C.push([x[J].x,x[J].y]);C=PerfectFreehand.getStroke(C,u);x=[];for(J=0;J<C.length;J++)x.push({x:C[J][0],y:C[J][1]});x.push(null)}C=x[0].x;var G=x[0].x,P=