Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxGraphView.prototype.stateValidated=function(g){null!=g.shape&&this.redrawEnumerationState(g);return T.apply(this,arguments)};mxGraphView.prototype.createEnumerationValue=function(g){g=decodeURIComponent(mxUtils.getValue(g.style,"enumerateValue",""));""==g&&(g=++this.enumerationState);return'<div style="padding:2px;border:1px solid gray;background:yellow;border-radius:2px;">'+mxUtils.htmlEntities(g)+"</div>"};mxGraphView.prototype.redrawEnumerationState=function(g){var y="1"==mxUtils.getValue(g.style,
"enumerate",0);y&&null==g.secondLabel?(g.secondLabel=new mxText("",new mxRectangle,mxConstants.ALIGN_LEFT,mxConstants.ALIGN_BOTTOM),g.secondLabel.size=12,g.secondLabel.state=g,g.secondLabel.dialect=mxConstants.DIALECT_STRICTHTML,this.graph.cellRenderer.initializeLabel(g,g.secondLabel)):y||null==g.secondLabel||(g.secondLabel.destroy(),g.secondLabel=null);y=g.secondLabel;if(null!=y){var H=g.view.scale,O=this.createEnumerationValue(g);g=this.graph.model.isVertex(g.cell)?new mxRectangle(g.x+g.width-4*
H,g.y+4*H,0,0):mxRectangle.fromPoint(g.view.getPoint(g));y.bounds.equals(g)&&y.value==O&&y.scale==H||(y.bounds=g,y.value=O,y.scale=H,y.redraw())}};var l=mxGraphView.prototype.validateBackgroundPage;mxGraphView.prototype.validateBackgroundPage=function(){l.apply(this,arguments);if(mxClient.IS_GC&&null!=this.getDrawPane()){var g=this.getDrawPane().parentNode;!this.graph.mathEnabled||mxClient.NO_FO||null!=this.webKitForceRepaintNode&&null!=this.webKitForceRepaintNode.parentNode||"svg"!=this.graph.container.firstChild.nodeName?