Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
if(0==S&&0==F)S=G,F=1;else if(Math.abs(S-G)<=(P||1==u&&J?g:0))F+=1;else if(1<F&&J){t=t.slice(0,u+1);break}else if(3<=t.length-u&&!J)F=0,p=S=0!=q?q:0,t.splice(0,0==u?1:u),u=-1;else break;0!=p||P||(S=p=G)}3==t.length&&t[1]==I&&(p=0)}g=function(O,N,T,m){var B=[];if(m){m=C;var K=0}else m=0,K=C;B.push(new mxPoint(O.x-m,O.y-K));B.push(new mxPoint(O.x+m,O.y+K));B.push(O);B.push(N);B.push(new mxPoint(N.x-m,N.y-K));B.push(new mxPoint(N.x+m,N.y+K));if(null!=T)return T.points=B,T;O=new mxPolyline(B,mxConstants.GUIDE_COLOR,
mxConstants.GUIDE_STROKEWIDTH);O.dialect=mxConstants.DIALECT_SVG;O.pointerEvents=!1;O.init(M.graph.getView().getOverlayPane());return O};S=function(O,N){if(O&&null!=M.guidesArrHor)for(O=0;O<M.guidesArrHor.length;O++)M.guidesArrHor[O].node.style.visibility="hidden";if(N&&null!=M.guidesArrVer)for(O=0;O<M.guidesArrVer.length;O++)M.guidesArrVer[O].node.style.visibility="hidden"};if(1<F&&F==t.length-1){F=[];q=M.guidesArrHor;D=[];E=0;u=t[0]==I?1:0;J=t[u].y+t[u].height;if(0<p)for(u=0;u<t.length-1;u++)d=