Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"crosshair";mxConnectionHandler.prototype.createEdgeState=function(x){x=this.graph.createCurrentEdgeStyle();x=this.graph.createEdge(null,null,null,null,null,x);x=new mxCellState(this.graph.view,x,this.graph.getCellStyle(x));for(var L in this.graph.currentEdgeStyle)x.style[L]=this.graph.currentEdgeStyle[L];if(null!=this.previous){var P=this.previous.style.newEdgeStyle;if(null!=P)try{var X=JSON.parse(P);for(L in X)x.style[L]=X[L]}catch(ea){}}x.style=this.graph.postProcessCellStyle(x.cell,x.style);return x};