Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
uf.vertex=!0;v.insert(uf);v.style+=a(e.Title,G)}catch(gb){console.log(gb)}Ge(v,e);ka(v,e,C);e.Hidden&&(v.visible=!1);return v}function Ge(u,F){if(F.Text_TRotation||F.TextRotation)try{var C=mxUtils.toDegree(F.Text_TRotation||0)+mxUtils.toDegree(F.TextRotation||0);if(!isNaN(C)&&0!=C&&u.value){var t=u.geometry.width,e=u.geometry.height,N=t,r=e,q=0,Z=0;if(-90==C||-270==C){N=e;r=t;var aa=(e-t)/2;q=-aa/t;Z=aa/e}C+=mxUtils.toDegree(F.Rotation);var U=u.style.split(";").filter(function(ja){return 0>ja.indexOf("fillColor=")&&
0>ja.indexOf("strokeColor=")&&0>ja.indexOf("rotation=")}).join(";"),wa=new mxCell(u.value,new mxGeometry(q,Z,N,r),U+"fillColor=none;strokeColor=none;rotation="+C+";");u.value=null;wa.geometry.relative=!0;wa.vertex=!0;u.insert(wa)}}catch(ja){console.log(ja)}}function Je(u,F,C,t,e){function N(Lb,$b){var Xa="";try{for(var pb=0;pb<Lb.text.length;pb++){var Nc=Lb.text[pb];if(Nc[0]=="t_"+$b){for(var Fc in Nc[1]){var Gc=Nc[1][Fc];if(Gc)switch(Fc){case "font":Xa+=y(Gc);break;case "bold":Xa+="font-weight: bold;";