Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
c){this.transPoint(a.targetPoint,c);this.transPoint(a.offset,c);b=a.points;if(null!=b)for(var d=0;d<b.length;d++)this.transPoint(b[d],c);this.transPoint(c,c)}return a};g.prototype.normalizeGraph=function(b){function a(E){null!=E&&(null==c?(c=E.x,d=E.y,f=E.x+(E.width||0),k=E.y+(E.height||0)):(c=Math.min(E.x,c),d=Math.min(E.y,d),f=Math.max(E.x+(E.width||0),f),k=Math.max(E.y+(E.height||0),k)))}var c,d,f,k,n;for(n in b.model.cells){var p=b.model.cells[n],x=p.geometry;if(null!=x&&1==p.parent.id)if(p.vertex)a(x);