Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.resetScrollbars=function(){var b=this.editor.graph,e=b.container;if(!this.editor.extendCanvas)e.scrollTop=0,e.scrollLeft=0,mxUtils.hasScrollbars(e)||b.view.setTranslate(0,0);else if(!this.editor.isChromelessView())if(mxUtils.hasScrollbars(e))if(b.pageVisible){var g=b.getPagePadding();e.scrollTop=Math.floor(g.y-this.editor.initialTopSpacing)-1;e.scrollLeft=Math.floor(Math.min(g.x,(e.scrollWidth-e.clientWidth)/2))-1;g=b.getGraphBounds();0<g.width&&0<g.height&&(g.x>e.scrollLeft+.9*
e.clientWidth&&(e.scrollLeft=Math.min(g.x+g.width-e.clientWidth,g.x-10)),g.y>e.scrollTop+.9*e.clientHeight&&(e.scrollTop=Math.min(g.y+g.height-e.clientHeight,g.y-10)))}else if(g=b.getGraphBounds(),0==g.width&&0==g.height)e.scrollLeft=(e.scrollWidth-e.clientWidth)/2,e.scrollTop=(e.scrollHeight-e.clientHeight)/2;else{var n=Math.max(g.width,b.scrollTileSize.width*b.view.scale);e.scrollTop=Math.floor(Math.max(0,g.y-Math.max(20,(e.clientHeight-Math.max(g.height,b.scrollTileSize.height*b.view.scale))/4)));
e.scrollLeft=Math.floor(Math.max(0,g.x-Math.max(0,(e.clientWidth-n)/2)))}else{g=mxRectangle.fromRectangle(b.pageVisible?b.view.getBackgroundPageBounds():b.getGraphBounds());n=b.view.translate;var y=b.view.scale;g.x=g.x/y-n.x;g.y=g.y/y-n.y;g.width/=y;g.height/=y;b.view.setTranslate(Math.floor(Math.max(0,(e.clientWidth-g.width)/2)-g.x+2),Math.floor((b.pageVisible?0:Math.max(0,(e.clientHeight-g.height)/4))-g.y+1))}};