Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
0>ja.indexOf("strokeColor=")&&0>ja.indexOf("rotation=")}).join(";"),wa=new mxCell(u.value,new mxGeometry(q,Z,N,r),U+"fillColor=none;strokeColor=none;rotation="+C+";");u.value=null;wa.geometry.relative=!0;wa.vertex=!0;u.insert(wa)}}catch(ja){console.log(ja)}}function Je(u,F,C,t,e){function N(Lb,$b){var Xa="";try{for(var pb=0;pb<Lb.text.length;pb++){var Nc=Lb.text[pb];if(Nc[0]=="t_"+$b){for(var Fc in Nc[1]){var Gc=Nc[1][Fc];if(Gc)switch(Fc){case "font":Xa+=y(Gc);break;case "bold":Xa+="font-weight: bold;";
break;case "italic":Xa+="font-style: italic;";break;case "underline":Xa+="text-decoration: underline;";break;case "size":Xa+="font-size:"+A(.75*Gc)+"px;";break;case "color":Xa+="color:"+T(Gc).substring(0,7)+";";break;case "fill":Xa+="background-color:"+T(Gc).substring(0,7)+";";break;case "align":Xa+="text-align:"+Gc+";"}}break}}}catch(Sd){}return Xa}try{var r=function(Lb,$b,Xa){Lb=Aa+Lb;ra[Lb]=$b;$b="";for(var pb=0;pb<U.length;pb++)$b+='<div style="'+ma[pb]+'">'+(Xa[U[pb]]||"&nbsp;")+"</div>";pb=