Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"none")};var Z=mxEdgeHandler.prototype.mouseUp;mxEdgeHandler.prototype.mouseUp=function(x,L){Z.apply(this,arguments);null!=this.linkHint&&"none"==this.linkHint.style.display&&(this.linkHint.style.display="")};mxEdgeHandler.prototype.updateHint=function(x,L){null==this.hint&&(this.hint=b(),this.state.view.graph.container.appendChild(this.hint));var P=this.graph.view.translate,X=this.graph.view.scale,ea=this.roundLength(L.x/X-P.x);P=this.roundLength(L.y/X-P.y);X=this.graph.view.unit;this.hint.innerHTML=
e(ea,X)+", "+e(P,X);this.hint.style.visibility="visible";if(this.isSource||this.isTarget)null!=this.constraintHandler&&null!=this.constraintHandler.currentConstraint&&null!=this.constraintHandler.currentFocus?(ea=this.constraintHandler.currentConstraint.point,this.hint.innerHTML="["+Math.round(100*ea.x)+"%, "+Math.round(100*ea.y)+"%]"):this.marker.hasValidState()&&(this.hint.style.visibility="hidden");this.hint.style.left=Math.round(x.getGraphX()-this.hint.clientWidth/2)+"px";this.hint.style.top=
Math.max(x.getGraphY(),L.y)+Editor.hintOffset+"px";null!=this.linkHint&&(this.linkHint.style.display="none")};Graph.prototype.expandedImage=Graph.createSvgImage(9,9,'<defs><linearGradient id="grad1" x1="50%" y1="0%" x2="50%" y2="100%"><stop offset="30%" style="stop-color:#f0f0f0;" /><stop offset="100%" style="stop-color:#AFB0B6;" /></linearGradient></defs><rect x="0" y="0" width="9" height="9" stroke="#8A94A5" fill="url(#grad1)" stroke-width="2"/><path d="M 2 4.5 L 7 4.5 z" stroke="#000"/>');Graph.prototype.collapsedImage=