Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function m(H){var K={};try{var P=H.getGraphBounds().clone(),Q=H.view.scale,R=H.view.translate,ha=Math.round(P.x/Q)-R.x,X=Math.round(P.y/Q)-R.y,T=H.pageFormat.width,V=H.pageFormat.height;0>ha&&(ha+=Math.ceil((R.x-P.x/Q)/T)*T);0>X&&(X+=Math.ceil((R.y-P.y/Q)/V)*V);var oa=Math.max(1,Math.ceil((P.width/Q+ha)/T)),ca=Math.max(1,Math.ceil((P.height/Q+X)/V));K.gridEnabled=H.gridEnabled;K.gridSize=H.gridSize;K.guidesEnabled=H.graphHandler.guidesEnabled;K.pageVisible=H.pageVisible;K.pageScale=H.pageScale;K.pageWidth=
H.pageFormat.width*oa;K.pageHeight=H.pageFormat.height*ca;K.backgroundClr=H.background;K.mathEnabled=H.mathEnabled;K.shadowVisible=H.shadowVisible}catch(qa){}return K}function g(H,K,P,Q){return b(H,K/J.CONVERSION_FACTOR,P,Q)}function b(H,K,P,Q){P=A(P,J.XMLNS,"Cell");P.setAttribute("N",H);P.setAttribute("V",K);Q&&P.setAttribute("F",Q);return P}function a(H,K,P,Q,R){var ha=A(R,J.XMLNS,"Row");ha.setAttribute("T",H);ha.setAttribute("IX",K);ha.appendChild(g("X",P,R));ha.appendChild(g("Y",Q,R));return ha}