Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.getValue(this.style,"line")?(c.moveTo(l+p/2,u),c.lineTo(l+p/2,u+t)):(c.moveTo(l,u+t/2),c.lineTo(l+p,u+t/2));c.end();c.stroke()};mxCellRenderer.registerShape("lineEllipse",va);mxUtils.extend(Fa,mxActor);Fa.prototype.redrawPath=function(c,l,u,p,t){l=Math.min(p,t/2);c.moveTo(0,0);c.lineTo(p-l,0);c.quadTo(p,0,p,t/2);c.quadTo(p,t,p-l,t);c.lineTo(0,t);c.close();c.end()};mxCellRenderer.registerShape("delay",Fa);mxUtils.extend(Ua,mxActor);Ua.prototype.size=.2;Ua.prototype.redrawPath=function(c,l,
u,p,t){l=Math.min(t,p);var B=Math.max(0,Math.min(l,l*parseFloat(mxUtils.getValue(this.style,"size",this.size))));l=(t-B)/2;u=l+B;var D=(p-B)/2;B=D+B;c.moveTo(0,l);c.lineTo(D,l);c.lineTo(D,0);c.lineTo(B,0);c.lineTo(B,l);c.lineTo(p,l);c.lineTo(p,u);c.lineTo(B,u);c.lineTo(B,t);c.lineTo(D,t);c.lineTo(D,u);c.lineTo(0,u);c.close();c.end()};mxCellRenderer.registerShape("cross",Ua);mxUtils.extend(ab,mxActor);ab.prototype.size=.25;ab.prototype.redrawPath=function(c,l,u,p,t){l=Math.min(p,t/2);u=Math.min(p-