Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
fb=Math.sqrt(ua*ua+qb*qb);D.x=(D.x+B.x)*na;D.y=(D.y+B.y)*na;t.call(this,fb,ua/fb,qb/fb,Za,I,D,ha)})},xb=function(c,l){return function(u){return[wb(u,["startWidth"],!0,function(p,t,B,D,ha){ha=mxUtils.getNumber(u.style,"startWidth",c)*u.view.scale+l;return new mxPoint(D.x+t*p/4+B*ha/2,D.y+B*p/4-t*ha/2)},function(p,t,B,D,ha,I){p=Math.sqrt(mxUtils.ptSegDistSq(D.x,D.y,ha.x,ha.y,I.x,I.y));u.style.startWidth=Math.round(2*p)/u.view.scale-l})]}},rb=function(c){return function(l){return[hb(l,["arrowWidth",