Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.bind(this,function(){function l(K){return null==K||null==K.boundingBox||!isNaN(K.boundingBox.x)&&!isNaN(K.boundingBox.y)&&!isNaN(K.boundingBox.width)&&!isNaN(K.boundingBox.height)}var n=u.getGraphBounds(),z=u.view.translate,C=u.view.scale;u.insertVertex(u.getDefaultParent(),null,"",n.x/C-z.x,n.y/C-z.y,n.width/C,n.height/C,"fillColor=none;strokeColor=red;");var D=0,M=0;u.view.states.visit(function(K,O){K=!0;l(O.shape)||(console.log("invalid shape",O.cell.id,O.shape),K=!1);l(O.text)||(console.log("invalid text",