Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.createViewState=function(b){var f=b.getAttribute("page"),m=parseFloat(b.getAttribute("pageScale")),d=parseFloat(b.getAttribute("pageWidth")),u=parseFloat(b.getAttribute("pageHeight")),v=b.getAttribute("background"),E=this.parseBackgroundImage(b.getAttribute("backgroundImage")),F=b.getAttribute("extFonts");if(F)try{F=F.split("|").map(function(L){L=L.split("^");return{name:L[0],url:L[1]}})}catch(L){console.log("ExtFonts format error: "+L.message)}return{gridEnabled:"0"!=b.getAttribute("grid"),
gridSize:parseFloat(b.getAttribute("gridSize"))||mxGraph.prototype.gridSize,guidesEnabled:"0"!=b.getAttribute("guides"),foldingEnabled:"0"!=b.getAttribute("fold"),shadowVisible:"1"==b.getAttribute("shadow"),pageVisible:this.isLightboxView()?!1:null!=f?"0"!=f:this.defaultPageVisible,background:null!=v&&0<v.length?v:null,backgroundImage:E,pageScale:isNaN(m)?mxGraph.prototype.pageScale:m,pageFormat:isNaN(d)||isNaN(u)?"undefined"===typeof mxSettings||null!=this.defaultPageFormat?mxGraph.prototype.pageFormat:
mxSettings.getPageFormat():new mxRectangle(0,0,d,u),tooltips:"0"!=b.getAttribute("tooltips"),connect:"0"!=b.getAttribute("connect"),arrows:"0"!=b.getAttribute("arrows"),mathEnabled:"1"==b.getAttribute("math"),selectionCells:null,defaultParent:null,scrollbars:this.defaultScrollbars,scale:1,hiddenTags:[],extFonts:F||[]}};