Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	function renderGrid()
	{
		if (gridColor == null) return;
			
		var view = graph.view;
		var gridImage = btoa(unescape(encodeURIComponent(view.createSvgGrid(gridColor))));
		gridImage = 'url(' + 'data:image/svg+xml;base64,' + gridImage + ')';
		var phase = graph.gridSize * view.gridSteps * view.scale;
		
		var x0 = 0;
		var y0 = 0;
		
		if (view.backgroundPageShape != null)
		{
			var bds = view.getBackgroundPageBounds();
			
			x0 = 1 + bds.x;
			y0 = 1 + bds.y;
		}
		
		// Computes the offset to maintain origin for grid
		var position = -Math.round(phase - mxUtils.mod(view.translate.x * view.scale - x0, phase)) + 'px ' +
			-Math.round(phase - mxUtils.mod(view.translate.y * view.scale - y0, phase)) + 'px';
		
		var pages = document.querySelectorAll('[id^=mxPage]');
		
		var cssTxt = 'margin: 0;padding: 0;background-image: ' + gridImage + ';background-position: ' + position;
		document.body.style.cssText = cssTxt;

		for (var i = 0; i < pages.length; i++)
		{
			pages[i].style.cssText = cssTxt;
		}
	};