Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.state.style[mxConstants.STYLE_ARCSIZE]=Math.round(Math.max(0,Math.min(u.width,2*(u.x+u.width-p.x)))):this.state.style[mxConstants.STYLE_ARCSIZE]=Math.round(Math.min(50,Math.max(0,100*(u.width-p.x+u.x)/Math.min(u.width,u.height))))})},hb=function(c,l,u,p,t,B,D){var ha=new mxHandle(c,null,mxVertexHandler.prototype.secondaryHandleImage);ha.execute=function(ua){for(var na=0;na<l.length;na++)this.copyStyle(l[na]);D&&D(ua)};ha.getPosition=u;ha.setPosition=p;ha.ignoreGrid=null!=t?t:!0;if(B){var I=ha.positionChanged;
ha.positionChanged=function(){I.apply(this,arguments);c.view.invalidate(this.state.cell);c.view.validate()}}return ha},Ab={link:function(c){return[mb(c,!0,10),mb(c,!1,10)]},flexArrow:function(c){var l=c.view.graph.gridSize/c.view.scale,u=[];mxUtils.getValue(c.style,mxConstants.STYLE_STARTARROW,mxConstants.NONE)!=mxConstants.NONE&&(u.push(wb(c,["width",mxConstants.STYLE_STARTSIZE,mxConstants.STYLE_ENDSIZE],!0,function(p,t,B,D,ha){p=(c.shape.getEdgeWidth()-c.shape.strokewidth)*c.view.scale;ha=3*mxUtils.getNumber(c.style,