Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"="),x=null,x=k?g.insertVertex(a,null,null,Math.floor(Math.round(100*d.x)/100),Math.floor(Math.round(100*d.y)/100),Math.floor(Math.round(100*n.x)/100),Math.floor(Math.round(100*n.y)/100),p):g.insertVertex(a,null,f,Math.floor(Math.round(100*d.x)/100),Math.floor(Math.round(100*d.y)/100),Math.floor(Math.round(100*n.x)/100),Math.floor(Math.round(100*n.y)/100),p),function(z,E,I){null==z.entries&&(z.entries=[]);for(var J=0;J<z.entries.length;J++)if(null!=z.entries[J].key.equals&&z.entries[J].key.equals(E)||
z.entries[J].key===E){z.entries[J].value=I;return}z.entries.push({key:E,value:I,getKey:function(){return this.key},getValue:function(){return this.value}})}(this.vertexMap,new h.mxgraph.io.vsdx.ShapePageId(c,b.getId()),x),b.setLabelOffset(x,p),k&&b.createLabelSubShape(g,x),x):null};m.calculateAbsolutePoint=function(g){for(var b=0,a=0;null!=g;){var c=g.geometry;null!=c&&(b+=c.x,a+=c.y);g=g.parent}return new mxPoint(b,a)};m.prototype.processEdgeGeo=function(g,b){try{var a=g.geomList.geomList[0].rows;