Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(function(h){(function(y){(function(A){(function(B){var m=function(){function g(b,a){this.noQuickDrag=this.noSnap=this.noShow=this.noLine=this.noFill=!1;this.rows=null;if((null!=b&&1==b.nodeType||null===b)&&(null!=a&&a instanceof Array||null===a))Array.prototype.slice.call(arguments),this.index=0,this.noQuickDrag=this.noSnap=this.noShow=this.noLine=this.noFill=!1,this.rows=null,this.index=0,this.index=this.getIndex$org_w3c_dom_Element(b),null!=a&&this.index<a.length&&this.inheritGeo(a[this.index]),
this.processGeoElem(b);else if((null!=b&&1==b.nodeType||null===b)&&void 0===a)Array.prototype.slice.call(arguments),this.index=0,this.noQuickDrag=this.noSnap=this.noShow=this.noLine=this.noFill=!1,this.rows=null,this.index=0,this.index=this.getIndex$org_w3c_dom_Element(b),this.processGeoElem(b);else throw Error("invalid overload");}g.prototype.getIndex$org_w3c_dom_Element=function(b){try{return parseInt(b.getAttribute("IX"))||0}catch(a){return 0}};g.prototype.getIndex=function(b){if(null!=b&&1==b.nodeType||