Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(x){return x};Graph.prototype.getSvg=function(x,L,P,X,ea,la,oa,xa,sa,va,Fa,Ua,ab,Na){var bb=null;if(null!=Na)for(bb=new mxDictionary,Fa=0;Fa<Na.length;Fa++)bb.put(Na[Fa],!0);if(Na=this.useCssTransforms)this.useCssTransforms=!1,this.view.revalidate(),this.sizeDidChange();try{L=null!=L?L:1;P=null!=P?P:0;ea=null!=ea?ea:!0;la=null!=la?la:!0;oa=null!=oa?oa:!0;va=null!=va?va:!1;var $a="page"==ab?this.view.getBackgroundPageBounds():la&&null==bb||X||"diagram"==ab?this.getGraphBounds():this.getBoundingBox(this.getSelectionCells()),