Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
l)for(x=0;x<l.length;x++)l[x].node.style.visibility=c?"visible":"hidden"};var f=mxGuide.prototype.destroy;mxGuide.prototype.destroy=function(){f.call(this);var c=this.guidesArrVer,k=this.guidesArrHor;if(null!=c){for(var l=0;l<c.length;l++)c[l].destroy();this.guidesArrVer=null}if(null!=k){for(l=0;l<k.length;l++)k[l].destroy();this.guidesArrHor=null}}})();function mxRuler(b,e,f,c){function k(){var A=b.diagramContainer;M.style.top=A.offsetTop-E+"px";M.style.left=A.offsetLeft-E+"px";M.style.width=(f?0:A.offsetWidth)+E+"px";M.style.height=(f?A.offsetHeight:0)+E+"px"}function l(A,H,L){if(null!=x)return A;var F;return function(){var S=this,p=arguments,q=L&&!F;clearTimeout(F);F=setTimeout(function(){F=null;L||A.apply(S,p)},H);q&&A.apply(S,p)}}var x=window.requestAnimationFrame||window.mozRequestAnimationFrame||window.webkitRequestAnimationFrame||window.msRequestAnimationFrame,