Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
D):l.y+l.height>D+z&&(l.height=D+z-l.y,l.y=Math.min(l.y,D+z));var M=(l.x-C)/n*100;n=100-(l.x+l.width-C)/n*100;C=(l.y-D)/z*100;l=100-(l.y+l.height-D)/z*100;return"inset("+mxUtils.format(C)+"% "+mxUtils.format(n)+"% "+mxUtils.format(l)+"% "+mxUtils.format(M)+"%"+(A?" round "+J+"%":S?" round 50%":"")+")"}function v(A){null!=H&&(!0!==A&&(H.model.setGeometry(c,R.clone()),J=5,x.value=J),H.model.setStyle(c,e+u()),H.selectAll(),t.style.visibility=q.checked?"visible":"hidden")}var E=document.createElement("div"),