Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
G.offsetTop);this.showShapePicker(Math.max(this.diagramContainer.scrollLeft+Math.max(24,T.x)),this.diagramContainer.scrollTop+T.y,null,null,null,null,mxUtils.bind(this,function(f){return e.getCenterInsertPoint(e.getBoundingBoxFromGeometry(f,!0))}),"simple"==c,!1)}mxEvent.consume(P)}));y.style.backgroundSize="24px";"simple"==c?y.style.flexShrink="0":y.style.marginBottom="4px";var C=!1,V=mxUtils.bind(this,function(P){if(P||document.body.contains(l)){P=function(D,E,M,k,x,F){null!=E&&D.setAttribute("title",
E);D.style.cursor="pointer";D.style.margin="simple"==c?"0px":"8px 0px 8px 2px";D.style.display="simple"==c?"inline-block":"block";l.appendChild(D);"simple"==c?D.style.opacity="0.7":null!=k&&(E=x,E=null!=E?E:30,F=null!=F?F:26,D.style.position="relative",D.style.overflow="visible",M=document.createElement("div"),M.style.position="absolute",M.style.fontSize="8px",M.style.left=E+"px",M.style.top=F+"px",mxUtils.write(M,k),D.appendChild(M));return D};l.innerText="";if(!C){var T=window.innerWidth||document.documentElement.clientWidth||