Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
[mxConstants.DIRECTION_EAST,mxConstants.DIRECTION_SOUTH,mxConstants.DIRECTION_WEST,mxConstants.DIRECTION_NORTH],Pa=mxUtils.getValue(lb.style,mxConstants.STYLE_DIRECTION,mxConstants.DIRECTION_EAST);this.setCellStyles(mxConstants.STYLE_DIRECTION,kb[mxUtils.mod(mxUtils.indexOf(kb,Pa)+(L?-1:1),kb.length)],[la])}X.push(la)}}}finally{P.endUpdate()}return X};Graph.prototype.stencilHasPlaceholders=function(x){if(null!=x&&null!=x.fgNode)for(x=x.fgNode.firstChild;null!=x;){if("text"==x.nodeName&&"1"==x.getAttribute("placeholders"))return!0;