Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.bind(this,function(){function p(S){return null==S||null==S.boundingBox||!isNaN(S.boundingBox.x)&&!isNaN(S.boundingBox.y)&&!isNaN(S.boundingBox.width)&&!isNaN(S.boundingBox.height)}var q=k.getGraphBounds(),C=k.view.translate,J=k.view.scale;k.insertVertex(k.getDefaultParent(),null,"",q.x/J-C.x,q.y/J-C.y,q.width/J,q.height/J,"fillColor=none;strokeColor=red;");var F=0,O=0;k.view.states.visit(function(S,K){S=!0;p(K.shape)||(console.log("invalid shape",K.cell.id,K.shape),S=!1);p(K.text)||(console.log("invalid text",