Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
N));null!=V.text&&V.text.checkBounds()&&(K.save(),V.text.paint(K),K.restore());V=z(N,M.XMLNS,"Section");V.setAttribute("N","Geometry");V.setAttribute("IX","0");for(H=0;H<T.length;H++)I=ca(T[H],!1,!0),V.appendChild(a(0==H?"MoveTo":"LineTo",H+1,I.x,I.y,N));V.appendChild(c("NoFill","1",N));V.appendChild(c("NoLine","0",N));L.appendChild(V);return L}function n(H,I,L,N,Q,ha,V){var T=H.geometry,W=T;if(null!=T)try{T.relative&&ha&&(W=T.clone(),T.x*=ha.width,T.y*=ha.height,H.vertex&&null!=T.offset&&(T.x+=T.offset.x,
T.y+=T.offset.y),T.relative=0);var oa=B(H.id);if(!H.treatAsSingle&&0<H.getChildCount()){var ca=d(oa+"10000",T,I,N,Q,V);ca.setAttribute("Type","Group");var qa=z(N,M.XMLNS,"Shapes");K.save();K.translate(-T.x,-T.y);var sa=T.clone();sa.x=0;sa.y=0;H.setGeometry(sa);H.treatAsSingle=!0;var Fa=n(H,I,L,N,T.height,T,!0);delete H.treatAsSingle;H.setGeometry(T);null!=Fa&&qa.appendChild(Fa);for(Q=0;Q<H.getChildCount();Q++)Fa=n(H.children[Q],I,L,N,T.height,T,!0),null!=Fa&&qa.appendChild(Fa);ca.appendChild(qa);
K.restore();return ca}if(H.vertex){ca=d(oa,T,I,N,Q,V);var ka=L.view.getState(H,!0);null!=ka&&(b(ka,ca,N),K.newShape(ca,ka,N),null!=ka.text&&ka.text.checkBounds()&&(K.save(),ka.text.paint(K),K.restore()),null!=ka.shape&&ka.shape.checkBounds()&&(K.save(),ka.shape.paint(K),K.restore()),ca.appendChild(K.getShapeGeo()),K.endShape(),ca.setAttribute("Type",K.getShapeType()));return ca}return p(H,I,L,N,Q,V)}finally{H.geometry=W}else return null}function x(H,I){var L=mxUtils.createXmlDocument(),N=z(L,M.XMLNS,