Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxEvent.getClientX(C),mxEvent.getClientY(C))},p=function(C){for(d.push(C);d.length>f;)d.shift()},q=function(C){var J=d.length;if(1===J%2||J>=f){var G=0,P=0,O,N=0;for(O=C;O<J;O++)N++,C=d[O],G+=C.x,P+=C.y;return{x:G/N,y:P/N}}return null}}}mxFreehand.prototype.NO_SMOOTHING=1;mxFreehand.prototype.MILD_SMOOTHING=4;mxFreehand.prototype.NORMAL_SMOOTHING=8;mxFreehand.prototype.VERY_SMOOTH_SMOOTHING=12;mxFreehand.prototype.SUPER_SMOOTH_SMOOTHING=16;mxFreehand.prototype.HYPER_SMOOTH_SMOOTHING=20;function P2PCollab(b,e,f){function c(N,T){try{if(!q){var m=e.file.getCurrentUser();if(p&&null!=m&&null!=m.displayName){var B={from:H,id:n,type:N,sessionId:e.clientId,userId:m.id,username:m.displayName,data:T,protocol:DrawioFileSync.PROTOCOL,editor:EditorUi.VERSION};B={bytes:e.objectToString(B),data:"aes"};B=JSON.stringify(B);C&&"cursor"!=N&&EditorUi.debug("P2PCollab: sending to socket server",[B]);n++;m=!C&&("cursor"==N||"selectionChange"==N);S&&!m&&O("message",B);if(m)for(p2pId in F)F[p2pId].send(B)}}}catch(K){null!=
window.console&&console.error(K,N,T)}}function k(N){if(b.shareCursorPosition&&!z.isMouseDown){var T=mxUtils.getOffset(z.container),m=z.view.translate,B=z.view.scale,K=null!=b.currentPage?b.currentPage.getId():null;c("cursor",{pageId:K,x:Math.round((N.getX()-T.x+z.container.scrollLeft)/B-m.x),y:Math.round((N.getY()-T.y+z.container.scrollTop)/B-m.y)})}}function l(N,T){var m=null!=b.currentPage?b.currentPage.getId():null;if(null!=N&&null!=N.cursor&&null!=N.lastCursor)if(null!=N.lastCursor.hide||!b.isShowRemoteCursors()||