Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
x.shape&&null!=x.shape.bounds){X=x.shape.direction;L=x.shape.bounds;var ea=x.shape.scale;P=L.width/ea;L=L.height/ea;if(X==mxConstants.DIRECTION_NORTH||X==mxConstants.DIRECTION_SOUTH)X=P,P=L,L=X;L=x.shape.getConstraints(x.style,P,L);if(null!=L)return L;if(null!=x.shape.stencil&&null!=x.shape.stencil.constraints)return x.shape.stencil.constraints;if(null!=x.shape.constraints)return x.shape.constraints}}return null};Graph.prototype.flipEdge=function(x){if(null!=x){var L=this.getCurrentCellStyle(x);L=
mxUtils.getValue(L,mxConstants.STYLE_ELBOW,mxConstants.ELBOW_HORIZONTAL)==mxConstants.ELBOW_HORIZONTAL?mxConstants.ELBOW_VERTICAL:mxConstants.ELBOW_HORIZONTAL;this.setCellStyles(mxConstants.STYLE_ELBOW,L,[x])}};Graph.prototype.isValidRoot=function(x){for(var L=this.model.getChildCount(x),P=0,X=0;X<L;X++){var ea=this.model.getChildAt(x,X);this.model.isVertex(ea)&&(ea=this.getCellGeometry(ea),null==ea||ea.relative||P++)}return 0<P||this.isContainer(x)};Graph.prototype.isValidDropTarget=function(x,L,