Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	EditorUi.prototype.saveScrollState = function()
	{
		var t = this.editor.graph.view.translate;
		var off = mxUtils.getOffset(this.diagramContainer);
		var x = this.diagramContainer.scrollLeft - off.x;
		var y = this.diagramContainer.scrollTop - off.y;

		if (this.embedViewport != null)
		{
			if (!Editor.inlineFullscreen)
			{
				x += this.embedViewport.x;
				y += this.embedViewport.y;
			}
			else
			{
				x -= this.embedViewport.x;
				y -= this.embedViewport.y;
			}
		}

		return {x: x, y: y, tx: t.x, ty: t.y};
	};