Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"dashed32"==u.StrokeStyle?"dashed=1;fixDash=1;dashPattern=6 5;":"dashed44"==u.StrokeStyle?"dashed=1;fixDash=1;dashPattern=8 8;":null!=u.StrokeStyle&&"dashed"==u.StrokeStyle.substring(0,6)?"dashed=1;fixDash=1;":""}function sa(u){return null!=u.LineWidth?Zb(mxConstants.STYLE_STROKEWIDTH,A(.75*parseFloat(u.LineWidth)),"1"):""}function Fa(u,F,C){var t="";u.FillColor&&u.FillColor.url?(C=u.FillColor.url,"fill"==u.FillColor.pos&&(t="imageAspect=0;")):"ImageSearchBlock2"==F.Class?C=u.URL:"UserImage2Block"==
F.Class&&null!=u.ImageFillProps&&null!=u.ImageFillProps.url&&(C=u.ImageFillProps.url);return null!=C?"image="+h(C)+";"+t:""}function ka(u,F,C){null!=F.Link&&0<F.Link.length&&C.setAttributeForCell(u,"link",n(F.Link[0]));null!=F.NoteHint&&F.NoteHint.t&&C.setAttributeForCell(u,"Notes",F.NoteHint.t);var t=[],e=C.convertValueToString(u),N=!1;if(null!=e){for(var r=0;match=xf.exec(e);){var q=match[0];N=!0;if(2<q.length){var Z=q.substring(2,q.length-2);"documentName"==Z?Z="filename":"pageName"==Z?Z="page":