Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
H.createVertexHandler=function(){var Q=S.apply(this,arguments);Q.livePreview=!1;return Q};if(null!=m)try{if("inset"==m.substring(0,5)){var l=c.geometry,n=L.width,z=L.height,C=(300-n)/2,D=(300-z)/2,M=m.match(/\(([^)]+)\)/)[1].split(/[ ,]+/),K=parseFloat(M[0]),O=parseFloat(M[1]),V=parseFloat(M[2]),k=parseFloat(M[3]);isFinite(K)&&isFinite(O)&&isFinite(V)&&isFinite(k)?(l.x=k/100*n+C,l.y=K/100*z+D,l.width=(100-O)/100*n+C-l.x,l.height=(100-V)/100*z+D-l.y,"round"==M[4]?"50%"==M[5]?p.setAttribute("checked",