Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Oa.dx||null!=Oa.dy)Ya.geometry.offset=new mxPoint(null!=Oa.dx?Oa.dx:0,null!=Oa.dy?Oa.dy:0);Ta.insert(Ya)}Ua.push(Ta);mxUtils.remove(Ha.invert?Na:Sa,Va)}}}});aa(oa,oa,ja);if(null!=A[oa.id])for(Ea=0;Ea<A[oa.id].length;Ea++)aa(oa,A[oa.id][Ea],ja)}}if(null!=Ca)for(ia=0;ia<t.length;ia++)for(oa=t[ia],Ea=0;Ea<Ca.length;Ea++)L.setAttributeForCell(oa,mxUtils.trim(Ca[Ea]),null);if(0<v.length){var la=new mxParallelEdgeLayout(L);la.spacing=W;la.checkOverlap=!0;var na=function(){0<la.spacing&&la.execute(L.getDefaultParent());
for(var Na=0;Na<v.length;Na++){var ra=L.getCellGeometry(v[Na]);ra.x=Math.round(L.snap(ra.x));ra.y=Math.round(L.snap(ra.y));"auto"==m&&(ra.width=Math.round(L.snap(ra.width)));"auto"==B&&(ra.height=Math.round(L.snap(ra.height)))}};if("["==ea.charAt(0)){var pa=Y;L.view.validate();this.executeLayouts(L.createLayouts(JSON.parse(ea)),function(){na();pa()});Y=null}else if("circle"==ea){var ha=new mxCircleLayout(L);ha.disableEdgeStyle=!1;ha.resetEdges=!1;var ka=ha.isVertexIgnored;ha.isVertexIgnored=function(Na){return ka.apply(this,