Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxGraphView.prototype.stateValidated=function(k){null!=k.shape&&this.redrawEnumerationState(k);return S.apply(this,arguments)};mxGraphView.prototype.createEnumerationValue=function(k){k=decodeURIComponent(mxUtils.getValue(k.style,"enumerateValue",""));""==k&&(k=++this.enumerationState);return'<div style="padding:2px;border:1px solid gray;background:yellow;border-radius:2px;">'+mxUtils.htmlEntities(k)+"</div>"};mxGraphView.prototype.redrawEnumerationState=function(k){var y="1"==mxUtils.getValue(k.style,
"enumerate",0);y&&null==k.secondLabel?(k.secondLabel=new mxText("",new mxRectangle,mxConstants.ALIGN_LEFT,mxConstants.ALIGN_BOTTOM),k.secondLabel.size=12,k.secondLabel.state=k,k.secondLabel.dialect=mxConstants.DIALECT_STRICTHTML,this.graph.cellRenderer.initializeLabel(k,k.secondLabel)):y||null==k.secondLabel||(k.secondLabel.destroy(),k.secondLabel=null);y=k.secondLabel;if(null!=y){var G=k.view.scale,P=this.createEnumerationValue(k);k=this.graph.model.isVertex(k.cell)?new mxRectangle(k.x+k.width-4*
G,k.y+4*G,0,0):mxRectangle.fromPoint(k.view.getPoint(k));y.bounds.equals(k)&&y.value==P&&y.scale==G||(y.bounds=k,y.value=P,y.scale=G,y.redraw())}};var l=mxGraphView.prototype.validateBackgroundPage;mxGraphView.prototype.validateBackgroundPage=function(){l.apply(this,arguments);if(mxClient.IS_GC&&null!=this.getDrawPane()){var k=this.getDrawPane().parentNode;!this.graph.mathEnabled||mxClient.NO_FO||null!=this.webKitForceRepaintNode&&null!=this.webKitForceRepaintNode.parentNode||"svg"!=this.graph.container.firstChild.nodeName?