Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.fitPages=function(b,e){var g=1;null==b&&(g=this.getPageLayout(),b=g.width,g=g.height);var n=this.pageScale,y=this.pageFormat,q=this.container.clientHeight-10,E=(this.container.clientWidth-10)/(b*y.width)/n;this.zoomTo(Math.floor(20*(e?E:Math.min(E,q/(g*y.height)/n)))/20);mxUtils.hasScrollbars(this.container)&&(g=this.getPagePadding(),this.container.scrollLeft=Math.min(g.x*this.view.scale,(this.container.scrollWidth-this.container.clientWidth)/2)-1,e||(this.container.scrollTop=2<=b?
Math.min(g.y,(this.container.scrollHeight-this.container.clientHeight)/2):g.y*this.view.scale-1))};