Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var G=0,P=0,O=I.geometry,N=mxUtils.format((J.geometry.x+3-O.x)/O.width);J=mxUtils.format((J.geometry.y+3-O.y)/O.height);0>N?(G=N*O.width,N=0):1<N&&(G=(N-1)*O.width,N=1);0>J?(P=J*O.height,J=0):1<J&&(P=(J-1)*O.height,J=1);return{x:N,y:J,dx:parseInt(G),dy:parseInt(P)}}function D(J){if(1==M.getSelectionCount()){var G=M.getSelectionCell();J&&(G.constObj=null);J=E(G);S.value=100*J.x;q.value=100*J.y;p.value=J.dx;C.value=J.dy;F.style.visibility=""}else F.style.visibility="hidden"}var z=document.createElement("div");