Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
["size"],function(m){var x=Math.min(m.width,m.height);x=Math.max(0,Math.min(1,mxUtils.getValue(this.state.style,"size",Va.prototype.size)))*x/2;return new mxPoint(m.getCenterX()-x,m.getCenterY()-x)},function(m,x){var p=Math.min(m.width,m.height);this.state.style.size=Math.max(0,Math.min(1,Math.min(Math.max(0,m.getCenterY()-x.y)/p*2,Math.max(0,m.getCenterX()-x.x)/p*2)))})]},note:function(c){return[hb(c,["size"],function(m){var x=Math.max(0,Math.min(m.width,Math.min(m.height,parseFloat(mxUtils.getValue(this.state.style,
"size",G.prototype.size)))));return new mxPoint(m.x+m.width-x,m.y+x)},function(m,x){this.state.style.size=Math.round(Math.max(0,Math.min(Math.min(m.width,m.x+m.width-x.x),Math.min(m.height,x.y-m.y))))})]},note2:function(c){return[hb(c,["size"],function(m){var x=Math.max(0,Math.min(m.width,Math.min(m.height,parseFloat(mxUtils.getValue(this.state.style,"size",L.prototype.size)))));return new mxPoint(m.x+m.width-x,m.y+x)},function(m,x){this.state.style.size=Math.round(Math.max(0,Math.min(Math.min(m.width,