Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
for(var Na=0;Na<v.length;Na++){var ra=L.getCellGeometry(v[Na]);ra.x=Math.round(L.snap(ra.x));ra.y=Math.round(L.snap(ra.y));"auto"==m&&(ra.width=Math.round(L.snap(ra.width)));"auto"==B&&(ra.height=Math.round(L.snap(ra.height)))}};if("["==ea.charAt(0)){var pa=Y;L.view.validate();this.executeLayouts(L.createLayouts(JSON.parse(ea)),function(){na();pa()});Y=null}else if("circle"==ea){var ha=new mxCircleLayout(L);ha.disableEdgeStyle=!1;ha.resetEdges=!1;var ka=ha.isVertexIgnored;ha.isVertexIgnored=function(Na){return ka.apply(this,
arguments)||0>mxUtils.indexOf(v,Na)};this.executeLayout(function(){ha.execute(L.getDefaultParent());na()},!0,Y);Y=null}else if("horizontaltree"==ea||"verticaltree"==ea||"auto"==ea&&Ua.length==2*v.length-1&&1==Va.length){L.view.validate();var ua=new mxCompactTreeLayout(L,"horizontaltree"==ea);ua.levelDistance=Q;ua.edgeRouting=!1;ua.resetEdges=!1;this.executeLayout(function(){ua.execute(L.getDefaultParent(),0<Va.length?Va[0]:null)},!0,Y);Y=null}else if("horizontalflow"==ea||"verticalflow"==ea||"auto"==