Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
e},ConnectionPointsDialog=function(b,e){function f(){null!=k&&k.destroy()}var c=document.createElement("div");c.style.userSelect="none";var k=null;this.init=function(){function l(J,G,P){J=new mxCell("",new mxGeometry(J,G,6,6),"shape=mxgraph.basic.x;fillColor=#29b6f2;strokeColor=#29b6f2;points=[];rotatable=0;resizable=0;connectable=0;editable=0;");J.vertex=!0;J.cp=!0;J.constObj=P;return M.addCell(J)}function x(J){J=M.getSelectionCells();M.deleteCells(J)}function y(){var J=parseInt(S.value)||0;J=0>