Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
u,p,t,B,D,ha,I,ua,na){B*=ha+ua;D*=ha+ua;var Za=t.clone();return function(){l.begin();l.moveTo(Za.x,Za.y);I?l.lineTo(Za.x-B-D/c,Za.y-D+B/c):l.lineTo(Za.x+D/c-B,Za.y-D-B/c);l.stroke()}}}(2));if("undefined"!==typeof mxVertexHandler){var mb=function(c,l,u){return wb(c,["width"],l,function(p,t,B,D,ha){ha=c.shape.getEdgeWidth()*c.view.scale+u;return new mxPoint(D.x+t*p/4+B*ha/2,D.y+B*p/4-t*ha/2)},function(p,t,B,D,ha,I){p=Math.sqrt(mxUtils.ptSegDistSq(D.x,D.y,ha.x,ha.y,I.x,I.y));c.style.width=Math.round(2*
p)/c.view.scale-u})},wb=function(c,l,u,p,t){return hb(c,l,function(B){var D=c.absolutePoints;if(null!=D&&0<D.length){var ha=D.length-1;B=c.view.translate;var I=c.view.scale,ua=u?D[0]:D[ha];D=u?D[1]:D[ha-1];ha=D.x-ua.x;var na=D.y-ua.y,Za=Math.sqrt(ha*ha+na*na);ua=p.call(this,Za,ha/Za,na/Za,ua,D);return new mxPoint(ua.x/I-B.x,ua.y/I-B.y)}return null},function(B,D,ha){var I=c.absolutePoints,ua=I.length-1;B=c.view.translate;var na=c.view.scale,Za=u?I[0]:I[ua];I=u?I[1]:I[ua-1];ua=I.x-Za.x;var qb=I.y-Za.y,