Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
c){this.transPoint(a.targetPoint,c);this.transPoint(a.offset,c);b=a.points;if(null!=b)for(var d=0;d<b.length;d++)this.transPoint(b[d],c);this.transPoint(c,c)}return a};g.prototype.normalizeGraph=function(b){function a(E){null!=E&&(null==c?(c=E.x,d=E.y,f=E.x+(E.width||0),k=E.y+(E.height||0)):(c=Math.min(E.x,c),d=Math.min(E.y,d),f=Math.max(E.x+(E.width||0),f),k=Math.max(E.y+(E.height||0),k)))}var c,d,f,k,n;for(n in b.model.cells){var p=b.model.cells[n],x=p.geometry;if(null!=x&&1==p.parent.id)if(p.vertex)a(x);
else for(a(x.sourcePoint),a(x.targetPoint),p=x.points,x=0;null!=p&&x<p.length;x++)a(p[x])}var z={x:c,y:d};for(n in b.model.cells)if(p=b.model.cells[n],x=p.geometry,null!=x&&1==p.parent.id&&(x.x-=c,x.y-=d,p.isEdge()))for(this.transPoint(x.sourcePoint,z),this.transPoint(x.targetPoint,z),this.transPoint(x.offset,z),p=x.points,x=0;null!=p&&x<p.length;x++)this.transPoint(p[x],z);return{width:f-c,height:k-d}};g.prototype.transPoint=function(b,a){null!=b&&(b.x-=a.x,b.y-=a.y)};g.prototype.processPage=function(b,