Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
na,t),c.lineTo(p-na,t-na),c.lineTo(p,t-na)),("fold"==ua||"default"==ua&&"fold"==B)&&fb&&Ga&&(c.moveTo(0,t-na),c.lineTo(na,t-na),c.lineTo(na,t))};mxCellRenderer.registerShape(Na.prototype.cst.RECT2,Na);Na.prototype.constraints=null;mxUtils.extend(bb,mxConnector);bb.prototype.origPaintEdgeShape=bb.prototype.paintEdgeShape;bb.prototype.paintEdgeShape=function(c,l,u){for(var p=[],t=0;t<l.length;t++)p.push(mxUtils.clone(l[t]));t=c.state.dashed;var B=c.state.fixDash;bb.prototype.origPaintEdgeShape.apply(this,
[c,p,u]);3<=c.state.strokeWidth&&(p=mxUtils.getValue(this.style,"fillColor",null),null!=p&&(c.setStrokeColor(p),c.setStrokeWidth(c.state.strokeWidth-2),c.setDashed(t,B),bb.prototype.origPaintEdgeShape.apply(this,[c,l,u])))};mxCellRenderer.registerShape("filledEdge",bb);"undefined"!==typeof StyleFormatPanel&&function(){var c=StyleFormatPanel.prototype.getCustomColors;StyleFormatPanel.prototype.getCustomColors=function(){var l=this.editorUi.getSelectionState(),u=c.apply(this,arguments);"umlFrame"==