Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
k.getModel())}));c.actions.addAction("testXmlImageExport",mxUtils.bind(this,function(){var l=new mxImageExport,y=k.getGraphBounds(),J=k.view.scale,G=mxUtils.createXmlDocument(),P=G.createElement("output");G.appendChild(P);G=new mxXmlCanvas2D(P);G.translate(Math.floor((1-y.x)/J),Math.floor((1-y.y)/J));G.scale(1/J);var p=0,z=G.save;G.save=function(){p++;z.apply(this,arguments)};var I=G.restore;G.restore=function(){p--;I.apply(this,arguments)};var Q=l.drawShape;l.drawShape=function(N){mxLog.debug("entering shape",
N,p);Q.apply(this,arguments);mxLog.debug("leaving shape",N,p)};l.drawState(k.getView().getState(k.model.root),G);mxLog.show();mxLog.debug(mxUtils.getXml(P));mxLog.debug("stateCounter",p)}));c.actions.addAction("testShowConsole",function(){mxLog.isVisible()?mxLog.window.fit():mxLog.show();mxLog.window.div.style.zIndex=mxPopupMenu.prototype.zIndex-2});var q=null,t=null,x=null,A=null,E=null,K=null,H=null;c.actions.addAction("testPerformance",mxUtils.bind(this,function(){null!=q?(k.view.revalidate=q,