Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
for(var Ma=0;Ma<t.length;Ma++){var ra=I.getCellGeometry(t[Ma]);ra.x=Math.round(I.snap(ra.x));ra.y=Math.round(I.snap(ra.y));"auto"==k&&(ra.width=Math.round(I.snap(ra.width)));"auto"==y&&(ra.height=Math.round(I.snap(ra.height)))}};if("["==ea.charAt(0)){var oa=Y;I.view.validate();this.executeLayouts(I.createLayouts(JSON.parse(ea)),function(){ma();oa()});Y=null}else if("circle"==ea){var fa=new mxCircleLayout(I);fa.disableEdgeStyle=!1;fa.resetEdges=!1;var ja=fa.isVertexIgnored;fa.isVertexIgnored=function(Ma){return ja.apply(this,
arguments)||0>mxUtils.indexOf(t,Ma)};this.executeLayout(function(){fa.execute(I.getDefaultParent());ma()},!0,Y);Y=null}else if("horizontaltree"==ea||"verticaltree"==ea||"auto"==ea&&Ua.length==2*t.length-1&&1==Va.length){I.view.validate();var sa=new mxCompactTreeLayout(I,"horizontaltree"==ea);sa.levelDistance=T;sa.edgeRouting=!1;sa.resetEdges=!1;this.executeLayout(function(){sa.execute(I.getDefaultParent(),0<Va.length?Va[0]:null)},!0,Y);Y=null}else if("horizontalflow"==ea||"verticalflow"==ea||"auto"==