Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(z){H=z};this.setAutoScroll=function(z){R=z};this.setOpenFill=function(z){J=z};this.setStopClickEnabled=function(z){g=z};this.setSelectInserted=function(z){q=z};this.setSmoothing=function(z){m=z};this.setPerfectFreehandMode=function(z){t=z};this.isPerfectFreehandMode=function(){return t};this.setBrushSize=function(z){p.size=z};this.getBrushSize=function(){return p.size};var x=function(z){e=z;b.getRubberband().setEnabled(!z);b.graphHandler.setSelectEnabled(!z);b.graphHandler.setMoveEnabled(!z);
b.container.style.cursor=z?"crosshair":"";b.fireEvent(new mxEventObject("freehandStateChanged"))};this.startDrawing=function(){x(!0)};this.isDrawing=function(){return e};var B=mxUtils.bind(this,function(z){if(d){var C=F.length,D=g&&0<E.length&&null!=F&&2>F.length;D||E.push.apply(E,F);F=[];E.push(null);u.push(d);d=null;(D||H)&&this.stopDrawing();H&&(!D||2<=C)&&this.startDrawing();mxEvent.consume(z)}}),I=new mxCell;I.edge=!0;var A=function(){var z=b.getCurrentCellStyle(I);z=mxUtils.getValue(b.currentVertexStyle,