Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
for(var jb=0;jb<A.length;jb++){var ib=O.getCellGeometry(A[jb]);ib.x=Math.round(O.snap(ib.x));ib.y=Math.round(O.snap(ib.y));"auto"==l&&(ib.width=Math.round(O.snap(ib.width)));"auto"==B&&(ib.height=Math.round(O.snap(ib.height)))}};if("["==ya.charAt(0)){var Na=ra;O.view.validate();this.executeLayouts(O.createLayouts(JSON.parse(ya)),function(){ab();Na()});ra=null}else if("circle"==ya){var bb=new mxCircleLayout(O);bb.disableEdgeStyle=!1;bb.resetEdges=!1;var $a=bb.isVertexIgnored;bb.isVertexIgnored=function(jb){return $a.apply(this,
arguments)||0>mxUtils.indexOf(A,jb)};this.executeLayout(function(){bb.execute(O.getDefaultParent());ab()},!0,ra);ra=null}else if("horizontaltree"==ya||"verticaltree"==ya||"auto"==ya&&sa.length==2*A.length-1&&1==xa.length){O.view.validate();var Ra=new mxCompactTreeLayout(O,"horizontaltree"==ya);Ra.levelDistance=Y;Ra.edgeRouting=!1;Ra.resetEdges=!1;this.executeLayout(function(){Ra.execute(O.getDefaultParent(),0<xa.length?xa[0]:null)},!0,ra);ra=null}else if("horizontalflow"==ya||"verticalflow"==ya||