Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
T="curved sourcePerimeterSpacing targetPerimeterSpacing startArrow startFill startSize endArrow endFill endSize".split(" "),F=!1,K=!1;this.setDefaultStyle=function(Q){try{y.getModel().isEdge(Q)?K=!1:F=!1;var Y=y.getCellStyle(Q,!1),m=[],C=[],M;for(M in Y)m.push(Y[M]),C.push(M);y.getModel().isEdge(Q)?y.currentEdgeStyle={}:y.currentVertexStyle={};this.fireEvent(new mxEventObject("styleChanged","keys",C,"values",m,"cells",[Q],"force",!0));y.getModel().isEdge(Q)?K=!0:F=!0}catch(ba){this.handleError(ba)}};