Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
p)/c.view.scale-u})},wb=function(c,l,u,p,t){return hb(c,l,function(B){var D=c.absolutePoints;if(null!=D&&0<D.length){var ha=D.length-1;B=c.view.translate;var I=c.view.scale,ua=u?D[0]:D[ha];D=u?D[1]:D[ha-1];ha=D.x-ua.x;var na=D.y-ua.y,Za=Math.sqrt(ha*ha+na*na);ua=p.call(this,Za,ha/Za,na/Za,ua,D);return new mxPoint(ua.x/I-B.x,ua.y/I-B.y)}return null},function(B,D,ha){var I=c.absolutePoints,ua=I.length-1;B=c.view.translate;var na=c.view.scale,Za=u?I[0]:I[ua];I=u?I[1]:I[ua-1];ua=I.x-Za.x;var qb=I.y-Za.y,
fb=Math.sqrt(ua*ua+qb*qb);D.x=(D.x+B.x)*na;D.y=(D.y+B.y)*na;t.call(this,fb,ua/fb,qb/fb,Za,I,D,ha)})},xb=function(c,l){return function(u){return[wb(u,["startWidth"],!0,function(p,t,B,D,ha){ha=mxUtils.getNumber(u.style,"startWidth",c)*u.view.scale+l;return new mxPoint(D.x+t*p/4+B*ha/2,D.y+B*p/4-t*ha/2)},function(p,t,B,D,ha,I){p=Math.sqrt(mxUtils.ptSegDistSq(D.x,D.y,ha.x,ha.y,I.x,I.y));u.style.startWidth=Math.round(2*p)/u.view.scale-l})]}},rb=function(c){return function(l){return[hb(l,["arrowWidth",