Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxVsdxCanvas2D.prototype.createGeoSec=function(){null!=this.geoSec&&this.shape.appendChild(this.geoSec);var g=this.createElt("Section");g.setAttribute("N","Geometry");g.setAttribute("IX",this.geoIndex++);this.geoSec=g;this.geoStepIndex=1;this.lastMoveToY=this.lastMoveToX=this.lastY=this.lastX=0};mxVsdxCanvas2D.prototype.newShape=function(g,y,z){this.geoIndex=0;this.shape=g;this.cellState=y;this.xmGeo=y.cell.geometry;this.xmlDoc=z;this.shapeImg=this.geoSec=null;this.shapeType="Shape";this.createGeoSec()};