Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxGraph.prototype.getBoundingBoxFromGeometry=function(a,b,c){b=null!=b?b:!1;var d=null;if(null!=a)for(var e=0;e<a.length;e++)if(b||this.model.isVertex(a[e])){var f=this.getCellGeometry(a[e]);if(null!=f){var g=null;if(this.model.isEdge(a[e])){g=function(m){null!=m&&(null==k?k=new mxRectangle(m.x,m.y,0,0):k.add(new mxRectangle(m.x,m.y,0,0)))};null==this.model.getTerminal(a[e],!0)&&g(f.getTerminalPoint(!0));null==this.model.getTerminal(a[e],!1)&&g(f.getTerminalPoint(!1));f=f.points;if(null!=f&&0<f.length)for(var k=
new mxRectangle(f[0].x,f[0].y,0,0),l=1;l<f.length;l++)g(f[l]);g=k}else l=this.model.getParent(a[e]),f.relative?this.model.isVertex(l)&&l!=this.view.currentRoot&&(k=this.getBoundingBoxFromGeometry([l],!1,null!=c?c:a),null!=k&&(g=new mxRectangle(f.x*k.width,f.y*k.height,f.width,f.height),0<=mxUtils.indexOf(null!=c?c:a,l)&&(g.x+=k.x,g.y+=k.y))):(g=mxRectangle.fromRectangle(f),this.model.isVertex(l)&&0<=mxUtils.indexOf(null!=c?c:a,l)&&(k=this.getBoundingBoxFromGeometry([l],!1,null!=c?c:a),null!=k&&(g.x+=
k.x,g.y+=k.y))),null!=g&&null!=f.offset&&(g.x+=f.offset.x,g.y+=f.offset.y),f=this.getCurrentCellStyle(a[e]),null!=g&&(f=mxUtils.getValue(f,mxConstants.STYLE_ROTATION,0),0!=f&&(g=mxUtils.getBoundingBox(g,f)));null!=g&&(null==d?d=mxRectangle.fromRectangle(g):d.add(g))}}return d};mxGraph.prototype.refresh=function(a){this.view.clear(a,null==a);this.view.validate();this.sizeDidChange();this.fireEvent(new mxEventObject(mxEvent.REFRESH))};