Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
r.Message&&(e=Pd(r.Message,e,u,C,t,F))}u.Hidden&&(e.visible=!1);return e}function Pd(u,F,C,t,e,N){var r=2*(parseFloat(u.Location)-.5);isNaN(r)&&null!=u.Text&&null!=u.Text.Location&&(r=2*(parseFloat(u.Text.Location)-.5));N=m(u);var q=mxCell;r=new mxGeometry(isNaN(r)?0:r,0,0,0);var Z=ge;var aa=C;if(G)aa=lb;else{var U="13",wa="";if(null!=u&&null!=u.Value&&null!=u.Value.m){wa=z(u.Value.m);for(var ja=0;ja<u.Value.m.length;ja++)if("s"==u.Value.m[ja].n&&u.Value.m[ja].v)U=A(.75*parseFloat(u.Value.m[ja].v));
else if("c"==u.Value.m[ja].n){var na=T(u.Value.m[ja].v);null!=na&&(na=na.substring(0,7));"#000000"==na&&(na="default");wa+="fontColor="+na+";"}wa+=k(aa);lb=""}aa=wa+";fontSize="+U+";"}q=new q(N,r,Z+aa);q.geometry.relative=!0;q.vertex=!0;if(u.Side)try{C.Action&&C.Action.Properties&&(C=C.Action.Properties);if(null!=t&&null!=e){var ra=t.geometry,Aa=e.geometry;var ma=Math.abs(ra.x+ra.width*C.Endpoint1.LinkX-(Aa.x+Aa.width*C.Endpoint2.LinkX));var Ba=Math.abs(ra.y+ra.height*C.Endpoint1.LinkY-(Aa.y+Aa.height*
C.Endpoint2.LinkY))}else ma=Math.abs(C.Endpoint1.x-C.Endpoint2.x),Ba=Math.abs(C.Endpoint1.y-C.Endpoint2.y);var Pa=mxUtils.getSizeForString(N.replace(/\n/g,"<br>"));q.geometry.offset=0==ma||ma<Ba?new mxPoint(Math.sign(C.Endpoint1.y-C.Endpoint2.y)*u.Side*(Pa.width/2+5+ma),0):new mxPoint(0,Math.sign(C.Endpoint2.x-C.Endpoint1.x)*u.Side*(Pa.height/2+5+Ba))}catch(Ca){console.log(Ca)}q.lucidchartObject=u;F.insert(q);return F}function Zb(u,F,C,t){null!=F&&null!=t&&(F=t(F));return null!=F&&F!=C?u+"="+F+";":