Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
g.addListener(mxEvent.SIZE,e);g.container.addEventListener("scroll",c);g.view.addListener("unitChanged",this.unitListener);b.addListener("pageViewChanged",this.pageListener);b.addListener("pageScaleChanged",this.pageListener);b.addListener("pageFormatChanged",this.pageListener);this.setStyle=function(A){z=A;M.style.background=z.bkgClr;t()};this.origGuideMove=mxGuide.prototype.move;mxGuide.prototype.move=function(A,H,L,F){if(f&&4<A.height||!f&&4<A.width){if(null!=D.guidePart)try{d.putImageData(D.guidePart.imgData1,
D.guidePart.x1,D.guidePart.y1),d.putImageData(D.guidePart.imgData2,D.guidePart.x2,D.guidePart.y2),d.putImageData(D.guidePart.imgData3,D.guidePart.x3,D.guidePart.y3)}catch(m){}var S=D.origGuideMove.apply(this,arguments);try{d.lineWidth=.5;d.strokeStyle=z.guideClr;d.setLineDash([2]);if(f){var p=A.y+S.y+E-this.graph.container.scrollTop;var q=0;var C=p+A.height/2;var J=E/2;var G=p+A.height;var P=0;var O=d.getImageData(q,p-1,E,3);n(q,p,E,p);p--;var N=d.getImageData(J,C-1,E,3);n(J,C,E,C);C--;var T=d.getImageData(P,
G-1,E,3);n(P,G,E,G);G--}else p=0,q=A.x+S.x+E-this.graph.container.scrollLeft,C=E/2,J=q+A.width/2,G=0,P=q+A.width,O=d.getImageData(q-1,p,3,E),n(q,p,q,E),q--,N=d.getImageData(J-1,C,3,E),n(J,C,J,E),J--,T=d.getImageData(P-1,G,3,E),n(P,G,P,E),P--;if(null==D.guidePart||D.guidePart.x1!=q||D.guidePart.y1!=p)D.guidePart={imgData1:O,x1:q,y1:p,imgData2:N,x2:J,y2:C,imgData3:T,x3:P,y3:G}}catch(m){}}else S=D.origGuideMove.apply(this,arguments);return S};this.origGuideDestroy=mxGuide.prototype.destroy;mxGuide.prototype.destroy=