Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxGraphView.prototype.updateFloatingTerminalPoint=function(K,R,W,d){if(null==R||null==K||"1"!=R.style.snapToPoint&&"1"!=K.style.snapToPoint)N.apply(this,arguments);else{R=this.getTerminalPort(K,R,d);var f=this.getNextPoint(K,W,d),k=this.graph.isOrthogonal(K),v=mxUtils.toRadians(Number(R.style[mxConstants.STYLE_ROTATION]||"0")),z=new mxPoint(R.getCenterX(),R.getCenterY());if(0!=v){var A=Math.cos(-v),H=Math.sin(-v);f=mxUtils.getRotatedPoint(f,A,H,z)}A=parseFloat(K.style[mxConstants.STYLE_PERIMETER_SPACING]||
0);A+=parseFloat(K.style[d?mxConstants.STYLE_SOURCE_PERIMETER_SPACING:mxConstants.STYLE_TARGET_PERIMETER_SPACING]||0);f=this.getPerimeterPoint(R,f,0==v&&k,A);0!=v&&(A=Math.cos(v),H=Math.sin(v),f=mxUtils.getRotatedPoint(f,A,H,z));K.setAbsoluteTerminalPoint(this.snapToAnchorPoint(K,R,W,d,f),d)}};mxGraphView.prototype.snapToAnchorPoint=function(K,R,W,d,f){if(null!=R&&null!=K){K=this.graph.getAllConnectionConstraints(R);d=W=null;if(null!=K)for(var k=0;k<K.length;k++){var v=this.graph.getConnectionPoint(R,