Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Na.dx||null!=Na.dy)Ya.geometry.offset=new mxPoint(null!=Na.dx?Na.dx:0,null!=Na.dy?Na.dy:0);Ra.insert(Ya)}Ua.push(Ra);mxUtils.remove(Fa.invert?Ma:Pa,Va)}}}});aa(pa,pa,ia);if(null!=x[pa.id])for(Ea=0;Ea<x[pa.id].length;Ea++)aa(pa,x[pa.id][Ea],ia)}}if(null!=Ba)for(ka=0;ka<q.length;ka++)for(pa=q[ka],Ea=0;Ea<Ba.length;Ea++)I.setAttributeForCell(pa,mxUtils.trim(Ba[Ea]),null);if(0<t.length){var la=new mxParallelEdgeLayout(I);la.spacing=U;la.checkOverlap=!0;var ma=function(){0<la.spacing&&la.execute(I.getDefaultParent());
for(var Ma=0;Ma<t.length;Ma++){var ra=I.getCellGeometry(t[Ma]);ra.x=Math.round(I.snap(ra.x));ra.y=Math.round(I.snap(ra.y));"auto"==k&&(ra.width=Math.round(I.snap(ra.width)));"auto"==y&&(ra.height=Math.round(I.snap(ra.height)))}};if("["==ea.charAt(0)){var oa=Y;I.view.validate();this.executeLayouts(I.createLayouts(JSON.parse(ea)),function(){ma();oa()});Y=null}else if("circle"==ea){var fa=new mxCircleLayout(I);fa.disableEdgeStyle=!1;fa.resetEdges=!1;var ja=fa.isVertexIgnored;fa.isVertexIgnored=function(Ma){return ja.apply(this,