Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxStencilRegistry.getStencil=function(b){var e=mxStencilRegistry.stencils[b];if(null==e&&null==mxCellRenderer.defaultShapes[b]&&mxStencilRegistry.dynamicLoading){var g=mxStencilRegistry.getBasenameForStencil(b);if(null!=g){e=mxStencilRegistry.libraries[g];if(null!=e){if(null==mxStencilRegistry.packages[g]){for(var n=0;n<e.length;n++){var y=e[n];if(!mxStencilRegistry.filesLoaded[y])if(mxStencilRegistry.filesLoaded[y]=!0,".xml"==y.toLowerCase().substring(y.length-4,y.length))mxStencilRegistry.loadStencilSet(y,
null);else if(".js"==y.toLowerCase().substring(y.length-3,y.length))try{if(mxStencilRegistry.allowEval){var q=mxUtils.load(y);null!=q&&200<=q.getStatus()&&299>=q.getStatus()&&eval.call(window,q.getText())}}catch(E){null!=window.console&&console.log("error in getStencil:",b,g,e,y,E)}}mxStencilRegistry.packages[g]=1}}else g=g.replace("_-_","_"),mxStencilRegistry.loadStencilSet(STENCIL_PATH+"/"+g+".xml",null);e=mxStencilRegistry.stencils[b]}}return e};