Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
f},ConnectionPointsDialog=function(b,f){function m(){null!=u&&u.destroy()}var d=document.createElement("div");d.style.userSelect="none";var u=null;this.init=function(){function v(C,D,M){C=new mxCell("",new mxGeometry(C,D,6,6),"shape=mxgraph.basic.x;fillColor=#29b6f2;strokeColor=#29b6f2;points=[];rotatable=0;resizable=0;connectable=0;editable=0;");C.vertex=!0;C.cp=!0;C.constObj=M;return R.addCell(C)}function E(C){C=R.getSelectionCells();R.deleteCells(C)}function F(){var C=parseInt(S.value)||0;C=0>