Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"px",this.secondDiv.style.width=this.graph.container.clientWidth+"px",this.secondDiv.style.height=Math.max(0,this.height)+"px",this.secondDiv.style.borderWidth=0>=this.height?"1px 0px 0px 0px":"1px 0px 1px 0px"):(this.div.style.backgroundColor="",this.div.style.borderWidth="",this.div.style.borderStyle="",null!=this.secondDiv&&(this.secondDiv.parentNode.removeChild(this.secondDiv),this.secondDiv=null)),L.consume()}};var ka=mxRubberband.prototype.reset;mxRubberband.prototype.reset=function(){null!=
this.secondDiv&&(this.secondDiv.parentNode.removeChild(this.secondDiv),this.secondDiv=null);ka.apply(this,arguments)};var qa=(new Date).getTime(),ra=0,pa=mxEdgeHandler.prototype.updatePreviewState;mxEdgeHandler.prototype.updatePreviewState=function(x,L,P,X){pa.apply(this,arguments);P!=this.currentTerminalState?(qa=(new Date).getTime(),ra=0):ra=(new Date).getTime()-qa;this.currentTerminalState=P};var wa=mxEdgeHandler.prototype.isOutlineConnectEvent;mxEdgeHandler.prototype.isOutlineConnectEvent=function(x){return mxEvent.isShiftDown(x.getEvent())&&