Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
p),d.getGeometry().offset=x;this.rotateChildEdge(g.getModel(),b,f,k,p);b=g.getModel().getGeometry(d);p.pop();p.shift();b.points=p;b.setTerminalPoint(f,!0);b.setTerminalPoint(k,!1);n.hasOwnProperty("curved")&&function(E,I){return E&&E.equals?E.equals(I):E===I}(function(E,I){return E[I]?E[I]:null}(n,"curved"),"1")&&(b=g.getModel().getGeometry(d),g=a.getControlPoints(c),b.points=g);this.processEdgeGeo(a,d);return d};m.prototype.rotateChildEdge=function(g,b,a,c,d){if(null!=b){var f=g.getGeometry(b);g=
g.getStyle(b);if(null!=f&&null!=g&&(b=g.indexOf("rotation="),-1<b))for(g=parseFloat(g.substring(b+9,g.indexOf(";",b))),b=f.width/2,f=f.height/2,m.rotatedEdgePoint(a,g,b,f),m.rotatedEdgePoint(c,g,b,f),a=0;a<d.length;a++)m.rotatedEdgePoint(d[a],g,b,f)}};m.prototype.sanitiseGraph=function(g){var b=g.getModel().getRoot();this.sanitiseCell(g,b)};m.prototype.sanitiseCell=function(g,b){for(var a=g.getModel(),c=a.getChildCount(b),d=[],f=0;f<c;f++){var k=a.getChildAt(b,f);this.sanitiseCell(g,k)&&d.push(k)}for(g=