Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	EditorUi.prototype.restoreScrollState = function(state)
	{
		var s = this.editor.graph.view.scale;
		var t = this.editor.graph.view.translate;
		var off = mxUtils.getOffset(this.diagramContainer);
		
		this.diagramContainer.scrollLeft = state.x + off.x + (t.x - state.tx) * s;
		this.diagramContainer.scrollTop = state.y + off.y + (t.y - state.ty) * s;
	};