Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.createShapePicker=function(b,e,g,n,y,q,E,N,T,F,K){K=null!=K?K:!0;var R=this.editor.graph,W=null;T=null!=T?T:function(k){k=k[0];var v=0,z=0,A=k.geometry;null!=A&&(R.model.isEdge(k)&&(k=A.getTerminalPoint(!1),A=new mxRectangle(0,0,k.x,k.y)),v=A.width/2,z=A.height/2);return new mxPoint(R.snap(Math.round(b/R.view.scale)-R.view.translate.x-v),R.snap(Math.round(e/R.view.scale)-R.view.translate.y-z))};if(null!=E&&0<E.length){var d=this;R=this.editor.graph;W=document.createElement("div");