Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
.5),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,l,u-p));c.push(new mxConnectionConstraint(new mxPoint(.5,1),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,u-p));c.push(new mxConnectionConstraint(new mxPoint(0,.5),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,p));return c};ma.prototype.getConstraints=function(c,l,u){c=[];mxUtils.getValue(this.style,mxConstants.STYLE_ARCSIZE,mxConstants.LINE_ARCSIZE);var p=Math.max(0,Math.min(u,parseFloat(mxUtils.getValue(this.style,
"size",this.size))));parseFloat(mxUtils.getValue(this.style,"position",this.position));var t=l*Math.max(0,Math.min(1,parseFloat(mxUtils.getValue(this.style,"position2",this.position2))));parseFloat(mxUtils.getValue(this.style,"base",this.base));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1));c.push(new mxConnectionConstraint(new mxPoint(.25,0),!1));c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));c.push(new mxConnectionConstraint(new mxPoint(.75,0),!1));c.push(new mxConnectionConstraint(new mxPoint(1,
0),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,l,.5*(u-p)));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,l,u-p));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,t,u));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,u-p));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,.5*(u-p)));l>=2*p&&c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));return c};mxRectangleShape.prototype.constraints=[new mxConnectionConstraint(new mxPoint(0,