Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
O.restore();return ca}if(H.vertex){ca=d(oa,T,K,Q,R,X);var ka=P.view.getState(H,!0);null!=ka&&(c(ka,ca,Q),O.newShape(ca,ka,Q),null!=ka.text&&ka.text.checkBounds()&&(O.save(),ka.text.paint(O),O.restore()),null!=ka.shape&&ka.shape.checkBounds()&&(O.save(),ka.shape.paint(O),O.restore()),ca.appendChild(O.getShapeGeo()),O.endShape(),ca.setAttribute("Type",O.getShapeType()));return ca}return n(H,K,P,Q,R,X)}finally{H.geometry=V}else return null}function x(H,K){var P=mxUtils.createXmlDocument(),Q=A(P,J.XMLNS,
"PageContents");Q.setAttributeNS("http://www.w3.org/2000/xmlns/","xmlns",J.XMLNS);Q.setAttributeNS("http://www.w3.org/2000/xmlns/","xmlns:r",J.XMLNS_R);var R=A(P,J.XMLNS,"Shapes");Q.appendChild(R);var ha=H.model,X=H.view.translate,T=H.view.scale,V=H.getGraphBounds();O.shiftX=0;O.shiftY=0;if(V.x/T<X.x||V.y/T<X.y)O.shiftX=Math.ceil((X.x-V.x/T)/H.pageFormat.width)*H.pageFormat.width,O.shiftY=Math.ceil((X.y-V.y/T)/H.pageFormat.height)*H.pageFormat.height;O.save();O.translate(-X.x,-X.y);O.scale(1/T);O.newPage();
T=H.model.getChildCells(H.model.root);X={};for(V=0;V<T.length;V++)X[T[V].id]=V;for(var oa in ha.cells)T=ha.cells[oa],V=null!=T.parent?X[T.parent.id]:null,null!=V&&(T=p(T,V,H,P,K.pageHeight),null!=T&&R.appendChild(T));H=A(P,J.XMLNS,"Connects");Q.appendChild(H);for(oa in ha.cells)T=ha.cells[oa],T.edge&&(T.source&&(K=A(P,J.XMLNS,"Connect"),K.setAttribute("FromSheet",B(T.id)),K.setAttribute("FromCell","BeginX"),K.setAttribute("ToSheet",B(T.source.id)),H.appendChild(K)),T.target&&(K=A(P,J.XMLNS,"Connect"),
K.setAttribute("FromSheet",B(T.id)),K.setAttribute("FromCell","EndX"),K.setAttribute("ToSheet",B(T.target.id)),H.appendChild(K)));P.appendChild(Q);O.restore();return P}function z(H,K,P,Q){H.file(K,(Q?"":'<?xml version="1.0" encoding="UTF-8" standalone="yes"?>')+mxUtils.getXml(P,"\n"))}function E(H,K,P,Q){var R=mxUtils.createXmlDocument(),ha=mxUtils.createXmlDocument(),X=A(R,J.XMLNS,"Pages");X.setAttributeNS("http://www.w3.org/2000/xmlns/","xmlns",J.XMLNS);X.setAttributeNS("http://www.w3.org/2000/xmlns/",