Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxEvent.getClientX(C),mxEvent.getClientY(C))},p=function(C){for(d.push(C);d.length>f;)d.shift()},q=function(C){var J=d.length;if(1===J%2||J>=f){var G=0,P=0,O,N=0;for(O=C;O<J;O++)N++,C=d[O],G+=C.x,P+=C.y;return{x:G/N,y:P/N}}return null}}}mxFreehand.prototype.NO_SMOOTHING=1;mxFreehand.prototype.MILD_SMOOTHING=4;mxFreehand.prototype.NORMAL_SMOOTHING=8;mxFreehand.prototype.VERY_SMOOTH_SMOOTHING=12;mxFreehand.prototype.SUPER_SMOOTH_SMOOTHING=16;mxFreehand.prototype.HYPER_SMOOTH_SMOOTHING=20;function P2PCollab(b,e,f){function c(N,T){try{if(!q){var m=e.file.getCurrentUser();if(p&&null!=m&&null!=m.displayName){var B={from:H,id:n,type:N,sessionId:e.clientId,userId:m.id,username:m.displayName,data:T,protocol:DrawioFileSync.PROTOCOL,editor:EditorUi.VERSION};B={bytes:e.objectToString(B),data:"aes"};B=JSON.stringify(B);C&&"cursor"!=N&&EditorUi.debug("P2PCollab: sending to socket server",[B]);n++;m=!C&&("cursor"==N||"selectionChange"==N);S&&!m&&O("message",B);if(m)for(p2pId in F)F[p2pId].send(B)}}}catch(K){null!=