Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
2)G=q(O),P.push([G.x,G.y]),y.push(G);c.setAttribute("d",PerfectFreehand.getSvgPathFromStroke(P,u))}else{l+=" L"+G.x+" "+G.y;P="";y=[];for(O=2;O<d.length;O+=2)G=q(O),P+=" L"+G.x+" "+G.y,y.push(G);c.setAttribute("d",l+P)}M&&(G=b.view.translate,b.scrollRectToVisible((new mxRectangle(C.x-G.x,C.y-G.y)).grow(20)));J.consume()}}),mouseUp:mxUtils.bind(this,function(C,J){c&&b.isEnabled()&&!b.isCellLocked(b.getDefaultParent())&&(H(J.getEvent()),J.consume())})});var S=function(C){return mxUtils.convertPoint(b.container,
mxEvent.getClientX(C),mxEvent.getClientY(C))},p=function(C){for(d.push(C);d.length>f;)d.shift()},q=function(C){var J=d.length;if(1===J%2||J>=f){var G=0,P=0,O,N=0;for(O=C;O<J;O++)N++,C=d[O],G+=C.x,P+=C.y;return{x:G/N,y:P/N}}return null}}}mxFreehand.prototype.NO_SMOOTHING=1;mxFreehand.prototype.MILD_SMOOTHING=4;mxFreehand.prototype.NORMAL_SMOOTHING=8;mxFreehand.prototype.VERY_SMOOTH_SMOOTHING=12;mxFreehand.prototype.SUPER_SMOOTH_SMOOTHING=16;mxFreehand.prototype.HYPER_SMOOTH_SMOOTHING=20;function P2PCollab(b,e,f){function c(N,T){try{if(!q){var m=e.file.getCurrentUser();if(p&&null!=m&&null!=m.displayName){var B={from:H,id:n,type:N,sessionId:e.clientId,userId:m.id,username:m.displayName,data:T,protocol:DrawioFileSync.PROTOCOL,editor:EditorUi.VERSION};B={bytes:e.objectToString(B),data:"aes"};B=JSON.stringify(B);C&&"cursor"!=N&&EditorUi.debug("P2PCollab: sending to socket server",[B]);n++;m=!C&&("cursor"==N||"selectionChange"==N);S&&!m&&O("message",B);if(m)for(p2pId in F)F[p2pId].send(B)}}}catch(K){null!=