Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
va,Ha=Ia+(Ta.x-Ia)/va-ha,Va=Sa+(Ta.y-Sa)/va-ha,Ua=new Image;Ua.onload=function(){try{for(var ia=-Math.round(Da-mxUtils.mod((Ia-Ha)*W,Da)),aa=-Math.round(Da-mxUtils.mod((Sa-Va)*W,Da));ia<wa;ia+=Da)for(var la=aa;la<Qa;la+=Da)pa.drawImage(Ua,ia/W,la/W);Aa()}catch(ma){null!=Q&&Q(ma)}};Ua.onerror=function(ia){null!=Q&&Q(ia)};Ua.src=Ea}else Aa()}catch(ia){null!=Q&&Q(ia)}});qa.onerror=function(Aa){null!=Q&&Q(Aa)};Y&&this.graph.addSvgShadow(da);this.graph.mathEnabled&&this.addMathCss(da);var ka=mxUtils.bind(this,