Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxGraph.prototype.getBoundingBoxFromGeometry=function(a,b,c){b=null!=b?b:!1;var d=null;if(null!=a)for(var e=0;e<a.length;e++)if(b||this.model.isVertex(a[e])){var f=this.getCellGeometry(a[e]);if(null!=f){var g=null;if(this.model.isEdge(a[e])){g=function(m){null!=m&&(null==k?k=new mxRectangle(m.x,m.y,0,0):k.add(new mxRectangle(m.x,m.y,0,0)))};null==this.model.getTerminal(a[e],!0)&&g(f.getTerminalPoint(!0));null==this.model.getTerminal(a[e],!1)&&g(f.getTerminalPoint(!1));f=f.points;if(null!=f&&0<f.length)for(var k=