Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
TableLayout.prototype.layoutRow=function(b,e,g,n){var y=this.graph.getModel(),q=y.getChildCells(b,!0);b=this.graph.getActualStartSize(b,!0);var E=b.x,N=0;null!=e&&(e=e.slice(),e.splice(0,0,b.x));for(var T=0;T<q.length;T++){var F=this.graph.getCellGeometry(q[T]);null!=F&&(F=F.clone(),F.y=b.y,F.height=g-b.y-b.height,null!=e?(F.x=e[T],F.width=e[T+1]-F.x,T==q.length-1&&T<e.length-2&&(F.width=n-F.x-b.x-b.width)):(F.x=E,E+=F.width,T==q.length-1?F.width=n-b.x-b.width-N:N+=F.width),F.alternateBounds=new mxRectangle(0,
0,F.width,F.height),y.setGeometry(q[T],F))}return N};