Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
if(0==S&&0==A)S=D,A=1;else if(Math.abs(S-D)<=(M||1==p&&C?e:0))A+=1;else if(1<A&&C){q=q.slice(0,p+1);break}else if(3<=q.length-p&&!C)A=0,l=S=0!=n?n:0,q.splice(0,0==p?1:p),p=-1;else break;0!=l||M||(S=l=D)}3==q.length&&q[1]==J&&(l=0)}e=function(K,O,V,k){var y=[];if(k){k=z;var G=0}else k=0,G=z;y.push(new mxPoint(K.x-k,K.y-G));y.push(new mxPoint(K.x+k,K.y+G));y.push(K);y.push(O);y.push(new mxPoint(O.x-k,O.y-G));y.push(new mxPoint(O.x+k,O.y+G));if(null!=V)return V.points=y,V;K=new mxPolyline(y,mxConstants.GUIDE_COLOR,
mxConstants.GUIDE_STROKEWIDTH);K.dialect=mxConstants.DIALECT_SVG;K.pointerEvents=!1;K.init(R.graph.getView().getOverlayPane());return K};S=function(K,O){if(K&&null!=R.guidesArrHor)for(K=0;K<R.guidesArrHor.length;K++)R.guidesArrHor[K].node.style.visibility="hidden";if(O&&null!=R.guidesArrVer)for(K=0;K<R.guidesArrVer.length;K++)R.guidesArrVer[K].node.style.visibility="hidden"};if(1<A&&A==q.length-1){A=[];n=R.guidesArrHor;N=[];L=0;p=q[0]==J?1:0;C=q[p].y+q[p].height;if(0<l)for(p=0;p<q.length-1;p++)c=