Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
G):p.y+p.height>G+C&&(p.height=G+C-p.y,p.y=Math.min(p.y,G+C));var P=(p.x-J)/q*100;q=100-(p.x+p.width-J)/q*100;J=(p.y-G)/C*100;p=100-(p.y+p.height-G)/C*100;return"inset("+mxUtils.format(J)+"% "+mxUtils.format(q)+"% "+mxUtils.format(p)+"% "+mxUtils.format(P)+"%"+(F?" round "+I+"%":S?" round 50%":"")+")"}function l(F){null!=z&&(!0!==F&&(z.model.setGeometry(d,M.clone()),I=5,A.value=I),z.model.setStyle(d,g+k()),z.selectAll(),v.style.visibility=t.checked?"visible":"hidden")}var x=document.createElement("div"),