Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
b.container.style.cursor=z?"crosshair":"";b.fireEvent(new mxEventObject("freehandStateChanged"))};this.startDrawing=function(){x(!0)};this.isDrawing=function(){return e};var B=mxUtils.bind(this,function(z){if(d){var C=F.length,D=g&&0<E.length&&null!=F&&2>F.length;D||E.push.apply(E,F);F=[];E.push(null);u.push(d);d=null;(D||H)&&this.stopDrawing();H&&(!D||2<=C)&&this.startDrawing();mxEvent.consume(z)}}),I=new mxCell;I.edge=!0;var A=function(){var z=b.getCurrentCellStyle(I);z=mxUtils.getValue(b.currentVertexStyle,