Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
z.str.concat('","w":');z.str=z.str.concat(H.width);z.str=z.str.concat(',"h":');z.str=z.str.concat(H.height);z.str=z.str.concat(',"title":');M=M.getName();null==M&&(M="");M=mxUtils.htmlEntities(JSON.stringify(M));z.str=z.str.concat(M);z.str=z.str.concat("}");E=","}};for(var J=f,O=0;O<I.length;O++)n(O);k=k.concat(z)}k=k.concat("]</mxlibrary>");if(a)try{a(k)}catch(M){null!=d?d(M):a("")}},c)};g.prototype.normalizeGeo=function(b){var a=b.getGeometry();a.x=0;a.y=0;var c=a.sourcePoint;if(b.isEdge()&&null!=
c){this.transPoint(a.targetPoint,c);this.transPoint(a.offset,c);b=a.points;if(null!=b)for(var d=0;d<b.length;d++)this.transPoint(b[d],c);this.transPoint(c,c)}return a};g.prototype.normalizeGraph=function(b){function a(E){null!=E&&(null==c?(c=E.x,d=E.y,f=E.x+(E.width||0),k=E.y+(E.height||0)):(c=Math.min(E.x,c),d=Math.min(E.y,d),f=Math.max(E.x+(E.width||0),f),k=Math.max(E.y+(E.height||0),k)))}var c,d,f,k,n;for(n in b.model.cells){var p=b.model.cells[n],x=p.geometry;if(null!=x&&1==p.parent.id)if(p.vertex)a(x);