Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"fillPath"===ba.type&&V.filled?M.fill():M.stroke()};return C};(function(){function m(Z,aa,ka){this.canvas=Z;this.rc=aa;this.shape=ka;this.canvas.setLineJoin("round");this.canvas.setLineCap("round");this.originalBegin=this.canvas.begin;this.canvas.begin=mxUtils.bind(this,m.prototype.begin);this.originalEnd=this.canvas.end;this.canvas.end=mxUtils.bind(this,m.prototype.end);this.originalRect=this.canvas.rect;this.canvas.rect=mxUtils.bind(this,m.prototype.rect);this.originalRoundrect=this.canvas.roundrect;
this.canvas.roundrect=mxUtils.bind(this,m.prototype.roundrect);this.originalEllipse=this.canvas.ellipse;this.canvas.ellipse=mxUtils.bind(this,m.prototype.ellipse);this.originalLineTo=this.canvas.lineTo;this.canvas.lineTo=mxUtils.bind(this,m.prototype.lineTo);this.originalMoveTo=this.canvas.moveTo;this.canvas.moveTo=mxUtils.bind(this,m.prototype.moveTo);this.originalQuadTo=this.canvas.quadTo;this.canvas.quadTo=mxUtils.bind(this,m.prototype.quadTo);this.originalCurveTo=this.canvas.curveTo;this.canvas.curveTo=
mxUtils.bind(this,m.prototype.curveTo);this.originalArcTo=this.canvas.arcTo;this.canvas.arcTo=mxUtils.bind(this,m.prototype.arcTo);this.originalClose=this.canvas.close;this.canvas.close=mxUtils.bind(this,m.prototype.close);this.originalFill=this.canvas.fill;this.canvas.fill=mxUtils.bind(this,m.prototype.fill);this.originalStroke=this.canvas.stroke;this.canvas.stroke=mxUtils.bind(this,m.prototype.stroke);this.originalFillAndStroke=this.canvas.fillAndStroke;this.canvas.fillAndStroke=mxUtils.bind(this,
m.prototype.fillAndStroke);this.path=[];this.passThrough=!1}m.prototype.moveOp="M";m.prototype.lineOp="L";m.prototype.quadOp="Q";m.prototype.curveOp="C";m.prototype.closeOp="Z";m.prototype.getStyle=function(Z,aa){var ka=1;if(null!=this.shape.state){var qa=this.shape.state.cell.id;if(null!=qa)for(var ra=0;ra<qa.length;ra++)ka=(ka<<5)-ka+qa.charCodeAt(ra)<<0}ka={strokeWidth:this.canvas.state.strokeWidth,seed:ka,preserveVertices:!0};qa=this.rc.getDefaultOptions();ka.stroke=Z?this.canvas.state.strokeColor===