Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
arguments);u()};u();var J=document.createElement("canvas");J.width=R.offsetWidth;J.height=R.offsetHeight;R.style.overflow="hidden";J.style.position="relative";R.appendChild(J);var c=J.getContext("2d");this.ui=b;var e=b.editor.graph;this.graph=e;this.container=R;this.canvas=J;var g=function(x,B,I,A,S){x=Math.round(x);B=Math.round(B);I=Math.round(I);A=Math.round(A);c.beginPath();c.moveTo(x+.5,B+.5);c.lineTo(I+.5,A+.5);c.stroke();S&&(m?(c.save(),c.translate(x,B),c.rotate(-Math.PI/2),c.fillText(S,0,0),
c.restore()):c.fillText(S,x,B))},q=function(){c.clearRect(0,0,J.width,J.height);c.beginPath();c.lineWidth=.7;c.strokeStyle=H.strokeClr;c.setLineDash([]);c.font="9px Arial";c.textAlign="center";var x=e.view.scale,B=e.view.getBackgroundPageBounds(),I=e.view.translate,A=e.pageVisible;I=A?L+(m?B.y-e.container.scrollTop:B.x-e.container.scrollLeft):L+(m?I.y*x-e.container.scrollTop:I.x*x-e.container.scrollLeft);var S=0;A&&(S=e.getPageLayout(),S=m?S.y*e.pageFormat.height:S.x*e.pageFormat.width);var l;switch(N.unit){case mxConstants.POINTS:var n=