Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
20),F.style=mxUtils.setStyle(F.style,"entryY",Math.round(20*C.style.entryY)/20))}}function Bf(u,F){if(u.model.contains(F)&&null!=F.style&&""!=F.style){u=F.style.split(";");for(var C={},t=[],e=u.length-1;0<=e;e--){var N=u[e].split("=");if(2!=N.length||null==C[N[0]])C[N[0]]=N[1],""!=u[e]&&t.push(u[e])}F.style=t.reverse().join(";")+";"}}function Af(u,F){if(u.model.contains(F)&&null!=F.children&&null!=F.geometry&&F.vertex&&"group;dropTarget=0;pointerEvents=0;"==F.style){for(var C=null,t=0;t<F.children.length;t++)if(F.children[t].vertex){var e=
F.children[t].geometry;if(null!=e&&0==e.x&&0==e.y&&e.width==F.geometry.width&&e.height==F.geometry.height){if(null!=C)return;C=F.children[t]}}F=C;if(null!=F&&(C=F.parent,""==u.convertValueToString(C))){if(null!=F.edges)for(t=0;t<F.edges.length;t++)F.edges[t].source==F&&F.edges[t].setTerminal(F.parent,!0),F.edges[t].target==F&&F.edges[t].setTerminal(F.parent,!1);if(null!=F.children&&0<F.children.length)for(e=F.children.slice(),t=0;t<e.length;t++)C.insert(e[t]);u.cellLabelChanged(C,u.convertValueToString(F));
C.style=mxUtils.setStyle(mxUtils.setStyle(F.style,"container","1"),"collapsible","0");F.removeFromParent()}}}function Df(){var u=new Graph;u.setExtendParents(!1);u.setExtendParentsOnAdd(!1);u.setConstrainChildren(!1);u.setHtmlLabels(!0);u.getModel().maintainEdgeParent=!1;return u}function Qd(u,F,C,t,e,N,r,q){this.nurbsValues=[1,3,0,0,100*(u+C),100-100*(1-(F+t)),0,1,100*(e+r),100-100*(1-(N+q)),0,1]}function Ke(u,F){try{for(var C=[],t=F.BoundingBox.w,e=F.BoundingBox.h,N=0;N<F.Shapes.length;N++){var r=