Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxConstants.STYLE_STROKECOLOR,mxUtils.getValue(z,mxConstants.STYLE_STROKECOLOR,"#000"));"default"==z&&(z=b.shapeForegroundColor);return z};this.createStyle=function(z){var C=";fillColor=none;";t&&(C=";lineShape=1;");return mxConstants.STYLE_SHAPE+"="+z+C};this.stopDrawing=function(){if(0<u.length){if(t){for(var z=[],C=0;C<E.length;C++)null!=E[C]&&z.push([E[C].x,E[C].y]);z=PerfectFreehand.getStroke(z,p);E=[];for(C=0;C<z.length;C++)E.push({x:z[C][0],y:z[C][1]});E.push(null)}z=E[0].x;var D=E[0].x,M=