Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
db=cb[bb].url;Graph.isCssFontUrl(db)?Za.writeln('<link rel="stylesheet" href="'+mxUtils.htmlEntities(db)+'" charset="UTF-8" type="text/css">'):(Za.writeln('<style type="text/css">'),Za.writeln('@font-face {\nfont-family: "'+mxUtils.htmlEntities(eb)+'";\nsrc: url("'+mxUtils.htmlEntities(db)+'");\n}'),Za.writeln("</style>"))}};if("undefined"!==typeof MathJax){var ib=Ja.renderPage;Ja.renderPage=function(Za,cb,bb,eb,db,kb){var jb=mxClient.NO_FO,fb=ib.apply(this,arguments);mxClient.NO_FO=jb;this.graph.mathEnabled?
this.mathEnabled=this.mathEnabled||!0:fb.className="geDisableMathJax";return fb}}Na=null;Ya=Q.shapeForegroundColor;$a=Q.shapeBackgroundColor;Wa=Q.enableFlowAnimation;Q.enableFlowAnimation=!1;null!=Q.themes&&"darkTheme"==Q.defaultThemeName&&(Na=Q.stylesheet,Q.stylesheet=Q.getDefaultStylesheet(),Q.shapeForegroundColor="#000000",Q.shapeBackgroundColor="#ffffff",Q.refresh());Ja.open(null,null,Ma,!0,ra);Q.enableFlowAnimation=Wa;null!=Na&&(Q.shapeForegroundColor=Ya,Q.shapeBackgroundColor=$a,Q.stylesheet=