Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
L[l]);if(null!=u){var A=(u.x-f.x)*(u.x-f.x)+(u.y-f.y)*(u.y-f.y);if(null==d||A<d)V=u,d=A}}null!=V&&(f=V)}return f};var S=mxStencil.prototype.evaluateTextAttribute;mxStencil.prototype.evaluateTextAttribute=function(L,R,V){var d=S.apply(this,arguments);"1"==L.getAttribute("placeholders")&&null!=V.state&&(d=V.state.view.graph.replacePlaceholders(V.state.cell,d));return d};var G=mxCellRenderer.prototype.createShape;mxCellRenderer.prototype.createShape=function(L){if(null!=L.style&&"undefined"!==typeof pako){var R=
mxUtils.getValue(L.style,mxConstants.STYLE_SHAPE,null);if(null!=R&&"string"===typeof R&&"stencil("==R.substring(0,8))try{var V=R.substring(8,R.length-1),d=mxUtils.parseXml(Graph.decompress(V));return new mxShape(new mxStencil(d.documentElement))}catch(f){null!=window.console&&console.log("Error in shape: "+f)}}return G.apply(this,arguments)}})();mxStencilRegistry.libraries={};mxStencilRegistry.dynamicLoading=!0;mxStencilRegistry.allowEval=!0;mxStencilRegistry.packages=[];