Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxVsdxCanvas2D.prototype.createRowRel=function(h,y,A,B,m,g,b,a,c,d,f,k,n,p){var x=this.createElt("Row");x.setAttribute("T",h);x.setAttribute("IX",y);x.appendChild(this.createCellElem("X",A,c));x.appendChild(this.createCellElem("Y",B,d));null!=m&&isFinite(m)&&x.appendChild(this.createCellElem("A",m,f));null!=g&&isFinite(g)&&x.appendChild(this.createCellElem("B",g,k));null!=b&&isFinite(b)&&x.appendChild(this.createCellElem("C",b,n));null!=a&&isFinite(a)&&x.appendChild(this.createCellElem("D",a,p));
return x};mxVsdxCanvas2D.prototype.begin=function(){1<this.geoStepIndex&&this.createGeoSec()};