Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"1",P)),K.appendChild(b("ShapeShdwBlur","0.05555555555555555",P)),K.appendChild(b("ShapeShdwShow",2,P)));1==H.style[mxConstants.STYLE_FLIPH]&&K.appendChild(b("FlipX",1,P));1==H.style[mxConstants.STYLE_FLIPV]&&K.appendChild(b("FlipY",1,P));1==H.style[mxConstants.STYLE_ROUNDED]&&K.appendChild(g("Rounding",.1*H.cell.geometry.width,P));(H=mxUtils.rgba2hex(H.style[mxConstants.STYLE_LABEL_BACKGROUNDCOLOR]))&&K.appendChild(b("TextBkgnd",H,P))}function d(H,K,P,Q,R,ha){var X=A(Q,J.XMLNS,"Shape");X.setAttribute("ID",
H);X.setAttribute("NameU","Shape"+H);X.setAttribute("LineStyle","0");X.setAttribute("FillStyle","0");X.setAttribute("TextStyle","0");H=K.width/2;var T=K.height/2;X.appendChild(g("PinX",K.x+H+(ha?0:O.shiftX),Q));X.appendChild(g("PinY",R-K.y-T-(ha?0:O.shiftY),Q));X.appendChild(g("Width",K.width,Q));X.appendChild(g("Height",K.height,Q));X.appendChild(g("LocPinX",H,Q));X.appendChild(g("LocPinY",T,Q));X.appendChild(b("LayerMember",P+"",Q));return X}function f(H,K){H=J.ARROWS_MAP[(null==H?"none":H)+"|"+