Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.createShapePicker=function(b,e,g,n,y,q,E,K,S,G,L){L=null!=L?L:!0;var R=this.editor.graph,V=null;S=null!=S?S:function(l){l=l[0];var u=0,A=0,B=l.geometry;null!=B&&(R.model.isEdge(l)&&(l=B.getTerminalPoint(!1),B=new mxRectangle(0,0,l.x,l.y)),u=B.width/2,A=B.height/2);return new mxPoint(R.snap(Math.round(b/R.view.scale)-R.view.translate.x-u),R.snap(Math.round(e/R.view.scale)-R.view.translate.y-A))};if(null!=E&&0<E.length){var d=this;R=this.editor.graph;V=document.createElement("div");