Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
gridSize:parseFloat(b.getAttribute("gridSize"))||mxGraph.prototype.gridSize,guidesEnabled:"0"!=b.getAttribute("guides"),foldingEnabled:"0"!=b.getAttribute("fold"),shadowVisible:"1"==b.getAttribute("shadow"),pageVisible:this.isLightboxView()?!1:null!=f?"0"!=f:this.defaultPageVisible,background:null!=v&&0<v.length?v:null,backgroundImage:E,pageScale:isNaN(m)?mxGraph.prototype.pageScale:m,pageFormat:isNaN(d)||isNaN(u)?"undefined"===typeof mxSettings||null!=this.defaultPageFormat?mxGraph.prototype.pageFormat:
mxSettings.getPageFormat():new mxRectangle(0,0,d,u),tooltips:"0"!=b.getAttribute("tooltips"),connect:"0"!=b.getAttribute("connect"),arrows:"0"!=b.getAttribute("arrows"),mathEnabled:"1"==b.getAttribute("math"),selectionCells:null,defaultParent:null,scrollbars:this.defaultScrollbars,scale:1,hiddenTags:[],extFonts:F||[]}};