Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxVsdxCanvas2D.prototype.quadTo=function(g,y,z,B){this.lastX=z;this.lastY=B;var m=this.state,h=this.xmGeo,c=h.height*m.scale,a=h.width*m.scale;g=(g-h.x+m.dx)*m.scale;y=(h.height-y+h.y-m.dy)*m.scale;z=(z-h.x+m.dx)*m.scale;B=(h.height-B+h.y-m.dy)*m.scale;g/=a;y/=c;z/=a;B/=c;this.geoSec.appendChild(this.createRowRel("RelQuadBezTo",this.geoStepIndex++,z,B,g,y))};