Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
g.getStyle(b);if(null!=f&&null!=g&&(b=g.indexOf("rotation="),-1<b))for(g=parseFloat(g.substring(b+9,g.indexOf(";",b))),b=f.width/2,f=f.height/2,m.rotatedEdgePoint(a,g,b,f),m.rotatedEdgePoint(c,g,b,f),a=0;a<d.length;a++)m.rotatedEdgePoint(d[a],g,b,f)}};m.prototype.sanitiseGraph=function(g){var b=g.getModel().getRoot();this.sanitiseCell(g,b)};m.prototype.sanitiseCell=function(g,b){for(var a=g.getModel(),c=a.getChildCount(b),d=[],f=0;f<c;f++){var k=a.getChildAt(b,f);this.sanitiseCell(g,k)&&d.push(k)}for(g=
0;g<d.length;g++)a.remove(d[g]);d=b.geometry;null!=d&&(0>d.height&&(d.height=Math.abs(d.height),d.y-=d.height,b.style+=";flipV=1;"),0>d.width&&(d.width=Math.abs(d.width),d.x-=d.width,b.style+=";flipH=1;"));0<c&&(c=a.getChildCount(b));d=(new String(a.getValue(b))).toString();g=a.getStyle(b);return 0!==c||!a.isVertex(b)||null!=a.getValue(b)&&0!==d.length||null==g||-1==g.indexOf(mxConstants.STYLE_FILLCOLOR+"=none")||-1==g.indexOf(mxConstants.STYLE_STROKECOLOR+"=none")||-1!=g.indexOf("image=")?!1:!0};