Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var J=m.calculateAbsolutePoint(k),O=E.geometry;z=new mxPoint((J.x+p.x-z.x)/O.width,(J.y+p.y-z.y)/O.height)}else I=!1;p=null;b=b.getTargetToSheet();b=null!=b?function(M,L){null==M.entries&&(M.entries=[]);for(var H=0;H<M.entries.length;H++)if(null!=M.entries[H].key.equals&&M.entries[H].key.equals(L)||M.entries[H].key===L)return M.entries[H].value;return null}(this.vertexMap,new h.mxgraph.io.vsdx.ShapePageId(a,b)):null;J=!0;null==b||0==b.geometry.width||0==b.geometry.height?b=g.insertVertex(k,null,null,