Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
c.begin(),c.moveTo(l,u),this.outline||ha?c.lineTo(l+p,u):c.moveTo(l+p,u),this.outline||ua?c.lineTo(l+p,u+t):c.moveTo(l+p,u+t),this.outline||na?c.lineTo(l,u+t):c.moveTo(l,u+t),(this.outline||I)&&c.lineTo(l,u),c.end(),c.stroke(),c.setLineCap("flat")):c.setStrokeColor(this.stroke)}};mxCellRenderer.registerShape("partialRectangle",sa);mxUtils.extend(va,mxEllipse);va.prototype.paintVertexShape=function(c,l,u,p,t){mxEllipse.prototype.paintVertexShape.apply(this,arguments);c.setShadow(!1);c.begin();"vertical"==
mxUtils.getValue(this.style,"line")?(c.moveTo(l+p/2,u),c.lineTo(l+p/2,u+t)):(c.moveTo(l,u+t/2),c.lineTo(l+p,u+t/2));c.end();c.stroke()};mxCellRenderer.registerShape("lineEllipse",va);mxUtils.extend(Fa,mxActor);Fa.prototype.redrawPath=function(c,l,u,p,t){l=Math.min(p,t/2);c.moveTo(0,0);c.lineTo(p-l,0);c.quadTo(p,0,p,t/2);c.quadTo(p,t,p-l,t);c.lineTo(0,t);c.close();c.end()};mxCellRenderer.registerShape("delay",Fa);mxUtils.extend(Ua,mxActor);Ua.prototype.size=.2;Ua.prototype.redrawPath=function(c,l,