Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Na[Ia].y+'" x3="'+La[Ia].x+'" y3="'+La[Ia].y+'"/>';var Ea=bb}else Ea=void 0;ja.push(Ea)}else ma=U[Aa.p2].x,Ba=U[Aa.p2].y,ma=100*ma/t,Ba=100*Ba/e,ma=Math.round(100*ma)/100,Ba=Math.round(100*Ba)/100,ja.push('<line x="'+ma+'" y="'+Ba+'"/>');na=Aa.p2}ja.push("</path>");ja.push("<fillstroke/>");ja.push("</foreground></shape>");C.push({shapeStencil:"stencil("+Graph.compress(ja.join(""))+")",FillColor:q,LineColor:Z,LineWidth:aa})}LucidImporter.stencilsMap[u]={text:F.Text,w:t,h:e,x:F.BoundingBox.x,y:F.BoundingBox.y,
stencils:C}}catch(Ra){console.log("Stencil parsing error:",Ra)}}function sc(u,F,C,t,e,N,r,q){u=new mxCell("",new mxGeometry(u,F,0,0),"strokeColor=none;fillColor=none;");u.vertex=!0;r.insert(u);N=[u];C=C.clone();q.insertEdge(C,!1);u.insertEdge(C,!0);N.push(C);t.push(e.addCell(C,null,null,null,null))}function fb(u,F,C,t,e,N,r,q,Z){u=new mxCell("",new mxGeometry(u,F,0,0),"strokeColor=none;fillColor=none;");u.vertex=!0;Z.insert(u);C=new mxCell("",new mxGeometry(C,t,0,0),"strokeColor=none;fillColor=none;");