Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(function(){var b=mxGraphView.prototype.resetValidationState;mxGraphView.prototype.resetValidationState=function(){b.apply(this,arguments);this.validEdges=[]};var e=mxGraphView.prototype.validateCellState;mxGraphView.prototype.validateCellState=function(L,R){R=null!=R?R:!0;var V=this.getState(L);null!=V&&R&&this.graph.model.isEdge(V.cell)&&null!=V.style&&1!=V.style[mxConstants.STYLE_CURVED]&&!V.invalid&&this.updateLineJumps(V)&&this.graph.cellRenderer.redraw(V,!1,this.isRendering());V=e.apply(this,
arguments);null!=V&&R&&this.graph.model.isEdge(V.cell)&&null!=V.style&&1!=V.style[mxConstants.STYLE_CURVED]&&this.validEdges.push(V);return V};var g=mxShape.prototype.paint;mxShape.prototype.paint=function(){g.apply(this,arguments);if(null!=this.state&&null!=this.node&&this.state.view.graph.enableFlowAnimation&&this.state.view.graph.model.isEdge(this.state.cell)&&"1"==mxUtils.getValue(this.state.style,"flowAnimation","0")){var L=this.node.getElementsByTagName("path");if(1<L.length){"1"!=mxUtils.getValue(this.state.style,