Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxVsdxCanvas2D.prototype.createGeoSec=function(){null!=this.geoSec&&this.shape.appendChild(this.geoSec);var h=this.createElt("Section");h.setAttribute("N","Geometry");h.setAttribute("IX",this.geoIndex++);this.geoSec=h;this.geoStepIndex=1;this.lastMoveToY=this.lastMoveToX=this.lastY=this.lastX=0};mxVsdxCanvas2D.prototype.newShape=function(h,y,A){this.geoIndex=0;this.shape=h;this.cellState=y;this.xmGeo=y.cell.geometry;this.xmlDoc=A;this.shapeImg=this.geoSec=null;this.shapeType="Shape";this.createGeoSec()};