Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
e.addListener(mxEvent.SIZE,f);e.container.addEventListener("scroll",d);e.view.addListener("unitChanged",this.unitListener);b.addListener("pageViewChanged",this.pageListener);b.addListener("pageScaleChanged",this.pageListener);b.addListener("pageFormatChanged",this.pageListener);this.setStyle=function(x){H=x;R.style.background=H.bkgClr;q()};this.origGuideMove=mxGuide.prototype.move;mxGuide.prototype.move=function(x,B,I,A){if(m&&4<x.height||!m&&4<x.width){if(null!=N.guidePart)try{c.putImageData(N.guidePart.imgData1,
N.guidePart.x1,N.guidePart.y1),c.putImageData(N.guidePart.imgData2,N.guidePart.x2,N.guidePart.y2),c.putImageData(N.guidePart.imgData3,N.guidePart.x3,N.guidePart.y3)}catch(k){}var S=N.origGuideMove.apply(this,arguments);try{c.lineWidth=.5;c.strokeStyle=H.guideClr;c.setLineDash([2]);if(m){var l=x.y+S.y+L-this.graph.container.scrollTop;var n=0;var z=l+x.height/2;var C=L/2;var D=l+x.height;var M=0;var K=c.getImageData(n,l-1,L,3);g(n,l,L,l);l--;var O=c.getImageData(C,z-1,L,3);g(C,z,L,z);z--;var V=c.getImageData(M,
D-1,L,3);g(M,D,L,D);D--}else l=0,n=x.x+S.x+L-this.graph.container.scrollLeft,z=L/2,C=n+x.width/2,D=0,M=n+x.width,K=c.getImageData(n-1,l,3,L),g(n,l,n,L),n--,O=c.getImageData(C-1,z,3,L),g(C,z,C,L),C--,V=c.getImageData(M-1,D,3,L),g(M,D,M,L),M--;if(null==N.guidePart||N.guidePart.x1!=n||N.guidePart.y1!=l)N.guidePart={imgData1:K,x1:n,y1:l,imgData2:O,x2:C,y2:z,imgData3:V,x3:M,y3:D}}catch(k){}}else S=N.origGuideMove.apply(this,arguments);return S};this.origGuideDestroy=mxGuide.prototype.destroy;mxGuide.prototype.destroy=