Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Q};var U=mxShape.prototype.paintGlassEffect;mxShape.prototype.paintGlassEffect=function(W,Q,V,X,Y,Z){null!=W.handJiggle&&W.handJiggle.constructor==m?(W.handJiggle.passThrough=!0,U.apply(this,arguments),W.handJiggle.passThrough=!1):U.apply(this,arguments)}})();Editor.fastCompress=function(m){return null==m||0==m.length||"undefined"===typeof pako?m:Graph.arrayBufferToString(pako.deflateRaw(m))};Editor.fastDecompress=function(m){return null==m||0==m.length||"undefined"===typeof pako?m:pako.inflateRaw(Graph.stringToArrayBuffer(atob(m)),
{to:"string"})};Editor.extractGraphModel=function(m,B,K){if(null!=m&&"undefined"!==typeof pako){var R=m.ownerDocument.getElementsByTagName("div"),U=[];if(null!=R&&0<R.length)for(var W=0;W<R.length;W++)if("mxgraph"==R[W].getAttribute("class")){U.push(R[W]);break}0<U.length&&(R=U[0].getAttribute("data-mxgraph"),null!=R?(U=JSON.parse(R),null!=U&&null!=U.xml&&(m=mxUtils.parseXml(U.xml),m=m.documentElement)):(U=U[0].getElementsByTagName("div"),0<U.length&&(R=mxUtils.getTextContent(U[0]),R=Graph.decompress(R,