Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
S="curved sourcePerimeterSpacing targetPerimeterSpacing startArrow startFill startSize endArrow endFill endSize".split(" "),G=!1,L=!1;this.setDefaultStyle=function(P){try{y.getModel().isEdge(P)?L=!1:G=!1;var U=y.getCellStyle(P,!1),k=[],z=[],J;for(J in U)k.push(U[J]),z.push(J);y.getModel().isEdge(P)?y.currentEdgeStyle={}:y.currentVertexStyle={};this.fireEvent(new mxEventObject("styleChanged","keys",z,"values",k,"cells",[P],"force",!0));y.getModel().isEdge(P)?L=!0:G=!0}catch(W){this.handleError(W)}};