Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxEvent.getClientX(C),mxEvent.getClientY(C))},p=function(C){for(d.push(C);d.length>f;)d.shift()},q=function(C){var J=d.length;if(1===J%2||J>=f){var F=0,O=0,S,K=0;for(S=C;S<J;S++)K++,C=d[S],F+=C.x,O+=C.y;return{x:F/K,y:O/K}}return null}}}mxFreehand.prototype.NO_SMOOTHING=1;mxFreehand.prototype.MILD_SMOOTHING=4;mxFreehand.prototype.NORMAL_SMOOTHING=8;mxFreehand.prototype.VERY_SMOOTH_SMOOTHING=12;mxFreehand.prototype.SUPER_SMOOTH_SMOOTHING=16;mxFreehand.prototype.HYPER_SMOOTH_SMOOTHING=20;function P2PCollab(b,e,f){function c(K,R){try{if(!q){var m=e.file.getCurrentUser();if(p&&null!=m&&null!=m.displayName){var A={from:H,id:n,type:K,sessionId:e.clientId,userId:m.id,username:m.displayName,data:R,protocol:DrawioFileSync.PROTOCOL,editor:EditorUi.VERSION};A={bytes:e.objectToString(A),data:"aes"};A=JSON.stringify(A);C&&"cursor"!=K&&EditorUi.debug("P2PCollab: sending to socket server",[A]);n++;m=!C&&("cursor"==K||"selectionChange"==K);T&&!m&&S("message",A);if(m)for(p2pId in G)G[p2pId].send(A)}}}catch(M){null!=
window.console&&console.error(M,K,R)}}function k(K){if(b.shareCursorPosition&&!z.isMouseDown){var R=mxUtils.getOffset(z.container),m=z.view.translate,A=z.view.scale,M=null!=b.currentPage?b.currentPage.getId():null;c("cursor",{pageId:M,x:Math.round((K.getX()-R.x+z.container.scrollLeft)/A-m.x),y:Math.round((K.getY()-R.y+z.container.scrollTop)/A-m.y)})}}function l(K,R){var m=null!=b.currentPage?b.currentPage.getId():null;if(null!=K&&null!=K.cursor&&null!=K.lastCursor)if(null!=K.lastCursor.hide||!b.isShowRemoteCursors()||