Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
va,Ga=Fa+(Qa.x-Fa)/va-da,Va=Ra+(Qa.y-Ra)/va-da,Ua=new Image;Ua.onload=function(){try{for(var ja=-Math.round(Da-mxUtils.mod((Fa-Ga)*V,Da)),aa=-Math.round(Da-mxUtils.mod((Ra-Va)*V,Da));ja<ta;ja+=Da)for(var la=aa;la<Ka;la+=Da)oa.drawImage(Ua,ja/V,la/V);ya()}catch(na){null!=U&&U(na)}};Ua.onerror=function(ja){null!=U&&U(ja)};Ua.src=Ea}else ya()}catch(ja){null!=U&&U(ja)}});qa.onerror=function(ya){null!=U&&U(ya)};Y&&this.graph.addSvgShadow(fa);this.graph.mathEnabled&&this.addMathCss(fa);var ia=mxUtils.bind(this,