Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.bind(this,function(){function p(O){return null==O||null==O.boundingBox||!isNaN(O.boundingBox.x)&&!isNaN(O.boundingBox.y)&&!isNaN(O.boundingBox.width)&&!isNaN(O.boundingBox.height)}var q=k.getGraphBounds(),C=k.view.translate,J=k.view.scale;k.insertVertex(k.getDefaultParent(),null,"",q.x/J-C.x,q.y/J-C.y,q.width/J,q.height/J,"fillColor=none;strokeColor=red;");var G=0,P=0;k.view.states.visit(function(O,N){O=!0;p(N.shape)||(console.log("invalid shape",N.cell.id,N.shape),O=!1);p(N.text)||(console.log("invalid text",