Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxVsdxCanvas2D.prototype.curveTo=function(g,y,z,B,m,h){this.lastX=m;this.lastY=h;var c=this.state,a=this.xmGeo,b=a.height*c.scale,d=a.width*c.scale;g=(g-a.x+c.dx)*c.scale;y=(a.height-y+a.y-c.dy)*c.scale;z=(z-a.x+c.dx)*c.scale;B=(a.height-B+a.y-c.dy)*c.scale;m=(m-a.x+c.dx)*c.scale;h=(a.height-h+a.y-c.dy)*c.scale;g/=d;y/=b;z/=d;B/=b;m/=d;h/=b;this.geoSec.appendChild(this.createRowRel("RelCubBezTo",this.geoStepIndex++,m,h,g,y,z,B))};