Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
AspectDialog.prototype.createViewer=function(b,f,m,d){mxEvent.disableContextMenu(b);b.style.userSelect="none";var u=new Graph(b);u.setTooltips(!1);u.setEnabled(!1);u.setPanning(!1);u.minFitScale=null;u.maxFitScale=null;u.centerZoom=!0;f="mxGraphModel"==f.nodeName?f:Editor.parseDiagramNode(f);if(null!=f){var v=f.getAttribute("background");if(null==v||""==v||v==mxConstants.NONE)v=null!=d?d:"#ffffff";b.style.backgroundColor=v;d=new mxCodec(f.ownerDocument);b=u.getModel();d.decode(f,b);f=b.getChildCount(b.root);
d=null==m;for(v=0;v<f;v++){var E=b.getChildAt(b.root,v);b.setVisible(E,d||m==E.id)}u.maxFitScale=1;u.fit(0);u.center()}return u};