Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
2)F=q(S),O.push([F.x,F.y]),y.push(F);c.setAttribute("d",PerfectFreehand.getSvgPathFromStroke(O,u))}else{l+=" L"+F.x+" "+F.y;O="";y=[];for(S=2;S<d.length;S+=2)F=q(S),O+=" L"+F.x+" "+F.y,y.push(F);c.setAttribute("d",l+O)}N&&(F=b.view.translate,b.scrollRectToVisible((new mxRectangle(C.x-F.x,C.y-F.y)).grow(20)));J.consume()}}),mouseUp:mxUtils.bind(this,function(C,J){c&&b.isEnabled()&&!b.isCellLocked(b.getDefaultParent())&&(H(J.getEvent()),J.consume())})});var T=function(C){return mxUtils.convertPoint(b.container,
mxEvent.getClientX(C),mxEvent.getClientY(C))},p=function(C){for(d.push(C);d.length>f;)d.shift()},q=function(C){var J=d.length;if(1===J%2||J>=f){var F=0,O=0,S,K=0;for(S=C;S<J;S++)K++,C=d[S],F+=C.x,O+=C.y;return{x:F/K,y:O/K}}return null}}}mxFreehand.prototype.NO_SMOOTHING=1;mxFreehand.prototype.MILD_SMOOTHING=4;mxFreehand.prototype.NORMAL_SMOOTHING=8;mxFreehand.prototype.VERY_SMOOTH_SMOOTHING=12;mxFreehand.prototype.SUPER_SMOOTH_SMOOTHING=16;mxFreehand.prototype.HYPER_SMOOTH_SMOOTHING=20;function P2PCollab(b,e,f){function c(K,R){try{if(!q){var m=e.file.getCurrentUser();if(p&&null!=m&&null!=m.displayName){var A={from:H,id:n,type:K,sessionId:e.clientId,userId:m.id,username:m.displayName,data:R,protocol:DrawioFileSync.PROTOCOL,editor:EditorUi.VERSION};A={bytes:e.objectToString(A),data:"aes"};A=JSON.stringify(A);C&&"cursor"!=K&&EditorUi.debug("P2PCollab: sending to socket server",[A]);n++;m=!C&&("cursor"==K||"selectionChange"==K);T&&!m&&S("message",A);if(m)for(p2pId in G)G[p2pId].send(A)}}}catch(M){null!=