Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
S+'" xmlns="'+mxConstants.NS_SVG+'"><defs><pattern id="grid" width="'+S+'" height="'+S+'" patternUnits="userSpaceOnUse"><path d="'+G.join(" ")+'" fill="none" stroke="'+E+'" opacity="0.2" stroke-width="1"/><path d="M '+S+" 0 L 0 0 0 "+S+'" fill="none" stroke="'+E+'" stroke-width="1"/></pattern></defs><rect width="100%" height="100%" fill="url(#grid)"/></svg>'};var b=mxGraph.prototype.panGraph;mxGraph.prototype.panGraph=function(E,K){b.apply(this,arguments);if(null!=this.shiftPreview1){var S=this.view.canvas;
null!=S.ownerSVGElement&&(S=S.ownerSVGElement);var G=this.gridSize*this.view.scale*this.view.gridSteps;G=-Math.round(G-mxUtils.mod(this.view.translate.x*this.view.scale+E,G))+"px "+-Math.round(G-mxUtils.mod(this.view.translate.y*this.view.scale+K,G))+"px";S.style.backgroundPosition=G}};mxGraph.prototype.updatePageBreaks=function(E,K,S){var G=this.view.scale,L=this.view.translate,R=this.pageFormat,V=G*this.pageScale,d=this.view.getBackgroundPageBounds();K=d.width;S=d.height;var f=new mxRectangle(G*