Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
oa.width/2,qa=oa.height/2;P.appendChild(g("PinX",oa.x+ca+(ha?0:O.shiftX),Q));P.appendChild(g("PinY",R-oa.y-qa-(ha?0:O.shiftY),Q));P.appendChild(g("Width",oa.width,Q));P.appendChild(g("Height",oa.height,Q));P.appendChild(g("LocPinX",ca,Q));P.appendChild(g("LocPinY",qa,Q));O.newEdge(P,X,Q);ca=function(sa,Fa,ka){var Za=sa.x;sa=sa.y;Za=Za*V.scale-oa.x+V.dx+(ka||ha?0:O.shiftX);sa=(Fa?0:oa.height)-sa*V.scale+oa.y-V.dy-(ka||ha?0:O.shiftY);return{x:Za,y:sa}};qa=ca(T[0],!0);P.appendChild(g("BeginX",oa.x+qa.x,