Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"";return u}function c(u,F,C,t,e,N){N=null==N?!1:N;var r="",q=!1,Z=!1;if(null!=u)if(N){N=u.split(";");u="";for(var aa=0;aa<N.length;aa++)"fillColor=none"==N[aa]?Z=!0:"strokeColor=none"==N[aa]?q=!0:""!=N[aa]&&(u+=N[aa]+";")}else""!=u&&";"!=u.charAt(u.length-1)&&(r=";");r+=(Xc(u,"whiteSpace")?"":"whiteSpace=wrap;")+(e?(Xc(u,"overflow")?"":"overflow=block;blockSpacing=1;")+(Xc(u,"html")?"":"html=1;")+"fontSize=13;"+lb:d(mxConstants.STYLE_FONTSIZE,u,F,C,t)+d(mxConstants.STYLE_FONTFAMILY,u,F,C,t)+d(mxConstants.STYLE_FONTCOLOR,
u,F,C,t)+d(mxConstants.STYLE_FONTSTYLE,u,F,C,t)+d(mxConstants.STYLE_ALIGN,u,F,C,t)+d(mxConstants.STYLE_SPACING_LEFT,u,F,C,t)+d(mxConstants.STYLE_SPACING_RIGHT,u,F,C,t)+d(mxConstants.STYLE_SPACING_TOP,u,F,C,t)+d(mxConstants.STYLE_SPACING_BOTTOM,u,F,C,t))+d(mxConstants.STYLE_ALIGN+"Global",u,F,C,t)+d(mxConstants.STYLE_SPACING,u,F,C,t)+d(mxConstants.STYLE_VERTICAL_ALIGN,u,F,C,t)+d(mxConstants.STYLE_STROKECOLOR,u,F,C,t)+d(mxConstants.STYLE_OPACITY,u,F,C,t)+d(mxConstants.STYLE_ROUNDED,u,F,C,t)+d(mxConstants.STYLE_ROTATION,
u,F,C,t)+d(mxConstants.STYLE_FLIPH,u,F,C,t)+d(mxConstants.STYLE_FLIPV,u,F,C,t)+d(mxConstants.STYLE_SHADOW,u,F,C,t)+d(mxConstants.STYLE_FILLCOLOR,u,F,C,t)+d(mxConstants.STYLE_DASHED,u,F,C,t)+d(mxConstants.STYLE_STROKEWIDTH,u,F,C,t)+d(mxConstants.STYLE_IMAGE,u,F,C,t)+d(mxConstants.STYLE_POINTER_EVENTS,u,F,C,t);Z&&!Xc(r,mxConstants.STYLE_FILLCOLOR)&&(r+="fillColor=none;");q&&!Xc(r,mxConstants.STYLE_STROKECOLOR)&&(r+="strokeColor=none;");lb="";return r}function d(u,F,C,t,e){if(!Xc(F,u))switch(u){case mxConstants.STYLE_FONTSIZE:return f(C);