Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
M+8,U=(A.y+K.lastCursor.y)*M-12,W=K.cursor.getElementsByTagName("img")[0];R?(mxUtils.setPrefixedStyle(K.cursor.style,"transition","all 900ms ease-out"),mxUtils.setPrefixedStyle(W.style,"transition","all 900ms ease-out"),window.setTimeout(m,0)):(mxUtils.setPrefixedStyle(K.cursor.style,"transition",null),mxUtils.setPrefixedStyle(W.style,"transition",null),m())}}function x(K,R){try{var m=function(){if(null==g[M]){var Z=B[M];null==Z&&(Z=N%d.length,B[M]=Z,N++);var da=d[Z];Z=11<Z?"black":"white";g[M]={cursor:document.createElement("div"),
color:da,selection:{}};u[R]=M;Q=g[M].cursor;Q.style.pointerEvents="none";Q.style.position="absolute";Q.style.display="none";Q.style.opacity="0.9";var ba=document.createElement("img");mxUtils.setPrefixedStyle(ba.style,"transform","rotate(-45deg)translateX(-14px)");ba.setAttribute("src",Graph.createSvgImage(8,12,'<path d="M 4 0 L 8 12 L 4 10 L 0 12 Z" stroke="'+da+'" fill="'+da+'"/>').src);ba.style.width="10px";Q.appendChild(ba);ba=document.createElement("div");ba.style.backgroundColor=da;ba.style.color=
Z;ba.style.fontSize="9pt";ba.style.padding="3px 7px";ba.style.marginTop="8px";ba.style.borderRadius="10px";ba.style.maxWidth="100px";ba.style.overflow="hidden";ba.style.textOverflow="ellipsis";ba.style.whiteSpace="nowrap";mxUtils.write(ba,A);Q.appendChild(ba);b.diagramContainer.appendChild(Q)}else Q=g[M].cursor;U=g[M].selection};if(!q){K=JSON.parse(K);null!=K.bytes&&(K=e.stringToObject(K.bytes));C&&"cursor"!=K.type&&EditorUi.debug("P2PCollab: msg received",[K]);if(null!=R){if(K.from==H||t[K.from]>=