Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.createCrossFunctionalSwimlane=function(b,e,g,n,y,q,E,N,T){g=null!=g?g:120;n=null!=n?n:120;E=null!=E?E:"shape=tableRow;horizontal=0;swimlaneHead=0;swimlaneBody=0;top=0;left=0;strokeColor=inherit;bottom=0;right=0;dropTarget=0;fontStyle=0;fillColor=none;points=[[0,0.5],[1,0.5]];portConstraint=eastwest;startSize=40;collapsible=0;recursiveResize=0;expand=0;";N=null!=N?N:"swimlane;swimlaneHead=0;swimlaneBody=0;fontStyle=0;strokeColor=inherit;connectable=0;fillColor=none;startSize=40;collapsible=0;recursiveResize=0;expand=0;";
T=null!=T?T:"swimlane;swimlaneHead=0;swimlaneBody=0;fontStyle=0;connectable=0;strokeColor=inherit;fillColor=none;startSize=0;collapsible=0;recursiveResize=0;expand=0;";y=this.createVertex(null,null,null!=y?y:"",0,0,e*g,b*n,null!=q?q:"shape=table;childLayout=tableLayout;"+(null==y?"startSize=0;fillColor=none;":"startSize=40;")+"collapsible=0;recursiveResize=0;expand=0;");q=mxUtils.getValue(this.getCellStyle(y),mxConstants.STYLE_STARTSIZE,mxConstants.DEFAULT_STARTSIZE);y.geometry.width+=q;y.geometry.height+=
q;E=this.createVertex(null,null,"",0,q,e*g+q,n,E);y.insert(this.createParent(E,this.createVertex(null,null,"",q,0,g,n,N),e,g,0));return 1<b?(E.geometry.y=n+q,this.createParent(y,this.createParent(E,this.createVertex(null,null,"",q,0,g,n,T),e,g,0),b-1,0,n)):y};