Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
E.style.backgroundPosition=d,E.style.backgroundImage=W,!R||null!=F.background&&F.background!=mxConstants.NONE?E.style.backgroundColor=K:(E.style.backgroundColor=F.diagramBackgroundColor,F.container.style.backgroundColor=""))};mxGraphView.prototype.createSvgGrid=function(E,N){for(N=this.graph.gridSize*this.scale*(null!=N?N:1);N<this.minGridSize;)N*=2;for(var T=this.gridSteps*N,F=[],K=1;K<this.gridSteps;K++){var R=K*N;F.push("M 0 "+R+" L "+T+" "+R+" M "+R+" 0 L "+R+" "+T)}return'<svg width="'+T+'" height="'+
T+'" xmlns="'+mxConstants.NS_SVG+'"><defs><pattern id="grid" width="'+T+'" height="'+T+'" patternUnits="userSpaceOnUse"><path d="'+F.join(" ")+'" fill="none" stroke="'+E+'" opacity="0.2" stroke-width="1"/><path d="M '+T+" 0 L 0 0 0 "+T+'" fill="none" stroke="'+E+'" stroke-width="1"/></pattern></defs><rect width="100%" height="100%" fill="url(#grid)"/></svg>'};var b=mxGraph.prototype.panGraph;mxGraph.prototype.panGraph=function(E,N){b.apply(this,arguments);if(null!=this.shiftPreview1){var T=this.view.canvas;