Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(function(){mxGraphView.prototype.validateBackgroundPage=function(){var E=this.graph;if(null!=E.container&&!E.transparentBackground){if(E.pageVisible){var N=this.getBackgroundPageBounds();if(null==this.backgroundPageShape){for(var T=E.container.firstChild;null!=T&&T.nodeType!=mxConstants.NODETYPE_ELEMENT;)T=T.nextSibling;null!=T&&(this.backgroundPageShape=this.createBackgroundPageShape(N),this.backgroundPageShape.scale=1,this.backgroundPageShape.isShadow=!0,this.backgroundPageShape.dialect=mxConstants.DIALECT_STRICTHTML,
this.backgroundPageShape.init(E.container),T.style.position="absolute",E.container.insertBefore(this.backgroundPageShape.node,T),this.backgroundPageShape.redraw(),this.backgroundPageShape.node.className="geBackgroundPage",mxEvent.addListener(this.backgroundPageShape.node,"dblclick",mxUtils.bind(this,function(F){E.dblClick(F)})),mxEvent.addGestureListeners(this.backgroundPageShape.node,mxUtils.bind(this,function(F){E.fireMouseEvent(mxEvent.MOUSE_DOWN,new mxMouseEvent(F))}),mxUtils.bind(this,function(F){null!=
E.tooltipHandler&&E.tooltipHandler.isHideOnHover()&&E.tooltipHandler.hide();E.isMouseDown&&!mxEvent.isConsumed(F)&&E.fireMouseEvent(mxEvent.MOUSE_MOVE,new mxMouseEvent(F))}),mxUtils.bind(this,function(F){E.fireMouseEvent(mxEvent.MOUSE_UP,new mxMouseEvent(F))})))}else this.backgroundPageShape.scale=1,this.backgroundPageShape.bounds=N,this.backgroundPageShape.redraw()}else null!=this.backgroundPageShape&&(this.backgroundPageShape.destroy(),this.backgroundPageShape=null);this.validateBackgroundStyles()}};