Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
q.getModel())}));d.actions.addAction("testXmlImageExport",mxUtils.bind(this,function(){var f=new mxImageExport,u=q.getGraphBounds(),D=q.view.scale,E=mxUtils.createXmlDocument(),M=E.createElement("output");E.appendChild(M);E=new mxXmlCanvas2D(M);E.translate(Math.floor((1-u.x)/D),Math.floor((1-u.y)/D));E.scale(1/D);var k=0,x=E.save;E.save=function(){k++;x.apply(this,arguments)};var F=E.restore;E.restore=function(){k--;F.apply(this,arguments)};var Q=f.drawShape;f.drawShape=function(N){mxLog.debug("entering shape",
N,k);Q.apply(this,arguments);mxLog.debug("leaving shape",N,k)};f.drawState(q.getView().getState(q.model.root),E);mxLog.show();mxLog.debug(mxUtils.getXml(M));mxLog.debug("stateCounter",k)}));d.actions.addAction("testShowConsole",function(){mxLog.isVisible()?mxLog.window.fit():mxLog.show();mxLog.window.div.style.zIndex=mxPopupMenu.prototype.zIndex-2});var p=null,n=null,t=null,y=null,A=null,G=null,C=null;d.actions.addAction("testPerformance",mxUtils.bind(this,function(){null!=p?(q.view.revalidate=p,