Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
la||ea))};Graph.prototype.createGroupCell=function(){var x=mxGraph.prototype.createGroupCell.apply(this,arguments);x.setStyle("group");return x};Graph.prototype.isExtendParentsOnAdd=function(x){var L=mxGraph.prototype.isExtendParentsOnAdd.apply(this,arguments);if(L&&null!=x&&null!=this.layoutManager){var P=this.model.getParent(x);null!=P&&(P=this.layoutManager.getLayout(P),null!=P&&P.constructor==mxStackLayout&&(L=!1))}return L};Graph.prototype.getPreferredSizeForCell=function(x){var L=mxGraph.prototype.getPreferredSizeForCell.apply(this,
arguments);null!=L&&(L.width+=10,L.height+=4,this.gridEnabled&&(L.width=this.snap(L.width),L.height=this.snap(L.height)));return L};Graph.prototype.turnShapes=function(x,L){var P=this.getModel(),X=[];P.beginUpdate();try{for(var ea=0;ea<x.length;ea++){var la=x[ea];if(P.isEdge(la)){var oa=P.getTerminal(la,!0),xa=P.getTerminal(la,!1);P.setTerminal(la,xa,!0);P.setTerminal(la,oa,!1);var sa=P.getGeometry(la);if(null!=sa){sa=sa.clone();null!=sa.points&&sa.points.reverse();var va=sa.getTerminalPoint(!0),