Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
case mxConstants.STYLE_FILLCOLOR:return ca(C,t);case mxConstants.STYLE_DASHED:return qa(C);case mxConstants.STYLE_STROKEWIDTH:return sa(C);case mxConstants.STYLE_IMAGE:return Fa(C,t);case mxConstants.STYLE_POINTER_EVENTS:return C.Magnetize?"container=1;pointerEvents=0;collapsible=0;recursiveResize=0;":""}return""}function f(u){u=b(u);if(null!=u)for(var F=0;F<u.length;){var C=u[F];if("s"==C.n&&C.v)return"fontSize="+A(.75*C.v)+";";F++}return"fontSize=13;"}function k(u){var F=b(u);if(null!=F)for(var C=