Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
G.y-J.x*H),K.moveTo(G.x,G.y)):"arc"==k?(H*=1.3,K.curveTo(fa.x-J.y*H,fa.y+J.x*H,G.x-J.y*H,G.y+J.x*H,G.x,G.y)):(K.moveTo(G.x,G.y),v=!0),H=[G],fa=!0))}else J=null;fa||(H.push(ja),z=ja)}this.addPoints(K,H,W,d,!1,null,v);K.stroke()}};var E=mxGraphView.prototype.getFixedTerminalPoint;mxGraphView.prototype.getFixedTerminalPoint=function(K,R,W,d){return null!=R&&"centerPerimeter"==R.style[mxConstants.STYLE_PERIMETER]?new mxPoint(R.getCenterX(),R.getCenterY()):E.apply(this,arguments)};var N=mxGraphView.prototype.updateFloatingTerminalPoint;