Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
0,c.width-parseFloat(mxUtils.getValue(this.style,"width",this.width)*this.scale),c.height-parseFloat(mxUtils.getValue(this.style,"height",this.height)*this.scale))};aa.prototype.paintBackground=function(c,l,u,p,t){var B=this.corner,D=Math.min(p,Math.max(B,parseFloat(mxUtils.getValue(this.style,"width",this.width)))),ha=Math.min(t,Math.max(1.5*B,parseFloat(mxUtils.getValue(this.style,"height",this.height)))),I=mxUtils.getValue(this.style,mxConstants.STYLE_SWIMLANE_FILLCOLOR,mxConstants.NONE);I!=mxConstants.NONE&&
(c.setFillColor(I),c.rect(l,u,p,t),c.fill());null!=this.fill&&this.fill!=mxConstants.NONE&&this.gradient&&this.gradient!=mxConstants.NONE?(this.getGradientBounds(c,l,u,p,t),c.setGradient(this.fill,this.gradient,l,u,p,t,this.gradientDirection)):c.setFillColor(this.fill);c.pointerEvents=!0;c.begin();c.moveTo(l,u);c.lineTo(l+D,u);c.lineTo(l+D,u+Math.max(0,ha-1.5*B));c.lineTo(l+Math.max(0,D-B),u+ha);c.lineTo(l,u+ha);c.close();c.fillAndStroke();this.configurePointerEvents(c);c.begin();c.moveTo(l+D,u);
c.lineTo(l+p,u);c.lineTo(l+p,u+t);c.lineTo(l,u+t);c.lineTo(l,u+ha);c.stroke()};mxCellRenderer.registerShape("umlFrame",aa);mxPerimeter.CenterPerimeter=function(c,l,u,p){return new mxPoint(c.getCenterX(),c.getCenterY())};mxStyleRegistry.putValue("centerPerimeter",mxPerimeter.CenterPerimeter);mxPerimeter.LifelinePerimeter=function(c,l,u,p){p=Z.prototype.size;null!=l&&(p=mxUtils.getValue(l.style,"size",p)*l.view.scale);l=parseFloat(l.style[mxConstants.STYLE_STROKEWIDTH]||1)*l.view.scale/2-1;u.x<c.getCenterX()&&