Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
db);return db}finally{Na&&(this.useCssTransforms=!0,this.view.revalidate(),this.sizeDidChange())}};Graph.prototype.addForeignObjectWarning=function(x,L){if("0"!=urlParams["svg-warning"]&&0<L.getElementsByTagName("foreignObject").length){var P=x.createElement("switch"),X=x.createElement("g");X.setAttribute("requiredFeatures","http://www.w3.org/TR/SVG11/feature#Extensibility");var ea=x.createElement("a");ea.setAttribute("transform","translate(0,-5)");null==ea.setAttributeNS||L.ownerDocument!=document&&
null==document.documentMode?(ea.setAttribute("xlink:href",Graph.foreignObjectWarningLink),ea.setAttribute("target","_blank")):(ea.setAttributeNS(mxConstants.NS_XLINK,"xlink:href",Graph.foreignObjectWarningLink),ea.setAttributeNS(mxConstants.NS_XLINK,"target","_blank"));x=x.createElement("text");x.setAttribute("text-anchor","middle");x.setAttribute("font-size","10px");x.setAttribute("x","50%");x.setAttribute("y","100%");mxUtils.write(x,Graph.foreignObjectWarningText);P.appendChild(X);ea.appendChild(x);
P.appendChild(ea);L.appendChild(P)}};Graph.prototype.updateSvgLinks=function(x,L,P){x=x.getElementsByTagName("a");for(var X=0;X<x.length;X++)if(null==x[X].getAttribute("target")){var ea=x[X].getAttribute("href");null==ea&&(ea=x[X].getAttribute("xlink:href"));null!=ea&&(null!=L&&/^https?:\/\//.test(ea)?x[X].setAttribute("target",L):P&&this.isCustomLink(ea)&&x[X].setAttribute("href","javascript:void(0);"))}};Graph.prototype.createSvgCanvas=function(x){x=new mxSvgCanvas2D(x);x.minStrokeWidth=this.cellRenderer.minSvgStrokeWidth;