Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
0>Y&&(Y=Q.strokeWidth/2);k.setStrokeAlpha(k.state.fillAlpha);k.setStrokeColor(Q.fill||"");k.setStrokeWidth(Y);k.setDashed(!1);this._drawToContext(G,P,Q);k.setDashed(X);k.setStrokeWidth(T);k.setStrokeColor(U);k.setStrokeAlpha(W)};y._drawToContext=function(G,P,Q){G.begin();for(var U=0;U<P.ops.length;U++){var T=P.ops[U],W=T.data;switch(T.op){case "move":G.moveTo(W[0],W[1]);break;case "bcurveTo":G.curveTo(W[0],W[1],W[2],W[3],W[4],W[5]);break;case "lineTo":G.lineTo(W[0],W[1])}}G.end();"fillPath"===P.type&&
Q.filled?G.fill():G.stroke()};return y};(function(){function k(U,T,W){this.canvas=U;this.rc=T;this.shape=W;this.canvas.setLineJoin("round");this.canvas.setLineCap("round");this.originalBegin=this.canvas.begin;this.canvas.begin=mxUtils.bind(this,k.prototype.begin);this.originalEnd=this.canvas.end;this.canvas.end=mxUtils.bind(this,k.prototype.end);this.originalRect=this.canvas.rect;this.canvas.rect=mxUtils.bind(this,k.prototype.rect);this.originalRoundrect=this.canvas.roundrect;this.canvas.roundrect=