Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
v)for(E=0;E<v.length;E++)v[E].node.style.visibility=d?"visible":"hidden"};var m=mxGuide.prototype.destroy;mxGuide.prototype.destroy=function(){m.call(this);var d=this.guidesArrVer,u=this.guidesArrHor;if(null!=d){for(var v=0;v<d.length;v++)d[v].destroy();this.guidesArrVer=null}if(null!=u){for(v=0;v<u.length;v++)u[v].destroy();this.guidesArrHor=null}}})();function mxRuler(b,f,m,d){function u(){var x=b.diagramContainer;R.style.top=x.offsetTop-L+"px";R.style.left=x.offsetLeft-L+"px";R.style.width=(m?0:x.offsetWidth)+L+"px";R.style.height=(m?x.offsetHeight:0)+L+"px"}function v(x,B,I){if(null!=E)return x;var A;return function(){var S=this,l=arguments,n=I&&!A;clearTimeout(A);A=setTimeout(function(){A=null;I||x.apply(S,l)},B);n&&x.apply(S,l)}}var E=window.requestAnimationFrame||window.mozRequestAnimationFrame||window.webkitRequestAnimationFrame||window.msRequestAnimationFrame,