Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
J.y,null,null,null,null,mxUtils.bind(this,function(G){return g.getCenterInsertPoint(g.getBoundingBoxFromGeometry(G,!0))}),"simple"==d,!1)}mxEvent.consume(C)}));A.style.backgroundSize="24px";"simple"==d?A.style.flexShrink="0":A.style.marginBottom="4px";var F=!1,S=mxUtils.bind(this,function(C){if(C||document.body.contains(n)){C=function(O,N,T,m,B,K){null!=N&&O.setAttribute("title",N);O.style.cursor="pointer";O.style.margin="simple"==d?"0px":"8px 0px 8px 2px";O.style.display="simple"==d?"inline-block":
"block";n.appendChild(O);"simple"==d?O.style.opacity="0.7":null!=m&&(N=B,N=null!=N?N:30,K=null!=K?K:26,O.style.position="relative",O.style.overflow="visible",T=document.createElement("div"),T.style.position="absolute",T.style.fontSize="8px",T.style.left=N+"px",T.style.top=K+"px",mxUtils.write(T,m),O.appendChild(T));return O};n.innerText="";if(!F){var J=window.innerWidth||document.documentElement.clientWidth||document.body.clientWidth;"simple"==d&&(this.sidebar.graph.cellRenderer.minSvgStrokeWidth=