Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxVsdxCanvas2D.prototype.quadTo=function(h,y,A,B){this.lastX=A;this.lastY=B;var m=this.state,g=this.xmGeo,b=g.height*m.scale,a=g.width*m.scale;h=(h-g.x+m.dx)*m.scale;y=(g.height-y+g.y-m.dy)*m.scale;A=(A-g.x+m.dx)*m.scale;B=(g.height-B+g.y-m.dy)*m.scale;h/=a;y/=b;A/=a;B/=b;this.geoSec.appendChild(this.createRowRel("RelQuadBezTo",this.geoStepIndex++,A,B,h,y))};