Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
C.translate(Math.floor((1-n.x)/z),Math.floor((1-n.y)/z));C.scale(1/z);var M=0,K=C.save;C.save=function(){M++;K.apply(this,arguments)};var O=C.restore;C.restore=function(){M--;O.apply(this,arguments)};var V=l.drawShape;l.drawShape=function(k){mxLog.debug("entering shape",k,M);V.apply(this,arguments);mxLog.debug("leaving shape",k,M)};l.drawState(u.getView().getState(u.model.root),C);mxLog.show();mxLog.debug(mxUtils.getXml(D));mxLog.debug("stateCounter",M)}));d.actions.addAction("testShowConsole",function(){mxLog.isVisible()?