Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
arguments);k()};k();var I=document.createElement("canvas");I.width=M.offsetWidth;I.height=M.offsetHeight;M.style.overflow="hidden";I.style.position="relative";M.appendChild(I);var d=I.getContext("2d");this.ui=b;var g=b.editor.graph;this.graph=g;this.container=M;this.canvas=I;var n=function(A,H,L,F,S){A=Math.round(A);H=Math.round(H);L=Math.round(L);F=Math.round(F);d.beginPath();d.moveTo(A+.5,H+.5);d.lineTo(L+.5,F+.5);d.stroke();S&&(f?(d.save(),d.translate(A,H),d.rotate(-Math.PI/2),d.fillText(S,0,0),
d.restore()):d.fillText(S,A,H))},t=function(){d.clearRect(0,0,I.width,I.height);d.beginPath();d.lineWidth=.7;d.strokeStyle=z.strokeClr;d.setLineDash([]);d.font="9px Arial";d.textAlign="center";var A=g.view.scale,H=g.view.getBackgroundPageBounds(),L=g.view.translate,F=g.pageVisible;L=F?E+(f?H.y-g.container.scrollTop:H.x-g.container.scrollLeft):E+(f?L.y*A-g.container.scrollTop:L.x*A-g.container.scrollLeft);var S=0;F&&(S=g.getPageLayout(),S=f?S.y*g.pageFormat.height:S.x*g.pageFormat.width);var p;switch(D.unit){case mxConstants.POINTS:var q=