Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
H.y-M.x*F),L.moveTo(H.x,H.y)):"arc"==l?(F*=1.3,L.curveTo(da.x-M.y*F,da.y+M.x*F,H.x-M.y*F,H.y+M.x*F,H.x,H.y)):(L.moveTo(H.x,H.y),u=!0),F=[H],da=!0))}else M=null;da||(F.push(ja),A=ja)}this.addPoints(L,F,V,d,!1,null,u);L.stroke()}};var E=mxGraphView.prototype.getFixedTerminalPoint;mxGraphView.prototype.getFixedTerminalPoint=function(L,R,V,d){return null!=R&&"centerPerimeter"==R.style[mxConstants.STYLE_PERIMETER]?new mxPoint(R.getCenterX(),R.getCenterY()):E.apply(this,arguments)};var K=mxGraphView.prototype.updateFloatingTerminalPoint;