Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function mxDualRuler(b,f){var m=new mxPoint(mxRuler.prototype.RULER_THICKNESS,mxRuler.prototype.RULER_THICKNESS);this.editorUiGetDiagContOffset=b.getDiagramContainerOffset;b.getDiagramContainerOffset=function(){return m};this.editorUiRefresh=b.refresh;this.ui=b;this.origGuideMove=mxGuide.prototype.move;this.origGuideDestroy=mxGuide.prototype.destroy;this.vRuler=new mxRuler(b,f,!0);this.hRuler=new mxRuler(b,f,!1,!0);f=mxUtils.bind(this,function(d){var u=!1;mxEvent.addGestureListeners(d,mxUtils.bind(this,
function(v){u=null!=b.currentMenu;mxEvent.consume(v)}),null,mxUtils.bind(this,function(v){if(b.editor.graph.isEnabled()&&!b.editor.graph.isMouseDown&&(mxEvent.isTouchEvent(v)||mxEvent.isPopupTrigger(v))){b.editor.graph.popupMenuHandler.hideMenu();b.hideCurrentMenu();if(!mxEvent.isTouchEvent(v)||!u){var E=new mxPopupMenu(mxUtils.bind(this,function(N,H){b.menus.addMenuItems(N,["points","inches","millimeters","meters"],H)}));E.div.className+=" geMenubarMenu";E.smartSeparators=!0;E.showDisabled=!0;E.autoExpand=
!0;E.hideMenu=mxUtils.bind(this,function(){mxPopupMenu.prototype.hideMenu.apply(E,arguments);b.resetCurrentMenu();E.destroy()});var F=mxEvent.getClientX(v),L=mxEvent.getClientY(v);E.popup(F,L,null,v);b.setCurrentMenu(E,d)}mxEvent.consume(v)}}))});f(this.hRuler.container);f(this.vRuler.container);this.vRuler.drawRuler();this.hRuler.drawRuler()}mxDualRuler.prototype.updateStyle=function(){this.vRuler.updateStyle();this.hRuler.updateStyle();this.vRuler.drawRuler();this.hRuler.drawRuler()};