Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
v.zOrder=C.ZOrder;Ge(v,C);C.Hidden&&(v.visible=!1);return v}function yf(u,F,C,t){var e=new mxCell("",new mxGeometry(0,0,100,100),"html=1;jettySize=18;");e.geometry.relative=!0;e.edge=!0;yb(e,u,F,C,t,!0);var N=g(u).Properties,r=null!=N?N.TextAreas:u.TextAreas;if(null!=r){for(var q=0;void 0!==r["t"+q];){var Z=r["t"+q];null!=Z&&(e=Pd(Z,e,u,C,t,F));q++}for(q=0;void 0!==r["m"+q]||1>q;)Z=r["m"+q],null!=Z&&(e=Pd(Z,e,u,C,t,F)),q++;null!=r.Text&&(e=Pd(r.Text,e,u,C,t,F));r=null!=N?N.TextAreas:u.TextAreas;null!=
r.Message&&(e=Pd(r.Message,e,u,C,t,F))}u.Hidden&&(e.visible=!1);return e}function Pd(u,F,C,t,e,N){var r=2*(parseFloat(u.Location)-.5);isNaN(r)&&null!=u.Text&&null!=u.Text.Location&&(r=2*(parseFloat(u.Text.Location)-.5));N=m(u);var q=mxCell;r=new mxGeometry(isNaN(r)?0:r,0,0,0);var Z=ge;var aa=C;if(G)aa=lb;else{var U="13",wa="";if(null!=u&&null!=u.Value&&null!=u.Value.m){wa=z(u.Value.m);for(var ja=0;ja<u.Value.m.length;ja++)if("s"==u.Value.m[ja].n&&u.Value.m[ja].v)U=A(.75*parseFloat(u.Value.m[ja].v));