Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
K.offsetTop);this.showShapePicker(Math.max(this.diagramContainer.scrollLeft+Math.max(24,U.x)),this.diagramContainer.scrollTop+U.y,null,null,null,null,mxUtils.bind(this,function(l){return g.getCenterInsertPoint(g.getBoundingBoxFromGeometry(l,!0))}),"simple"==d,!1)}mxEvent.consume(S)}));A.style.backgroundSize="24px";"simple"==d?A.style.flexShrink="0":A.style.marginBottom="4px";var H=!1,V=mxUtils.bind(this,function(S){if(S||document.body.contains(n)){S=function(J,G,P,p,z,I){null!=G&&J.setAttribute("title",
G);J.style.cursor="pointer";J.style.margin="simple"==d?"0px":"8px 0px 8px 2px";J.style.display="simple"==d?"inline-block":"block";n.appendChild(J);"simple"==d?J.style.opacity="0.7":null!=p&&(G=z,G=null!=G?G:30,I=null!=I?I:26,J.style.position="relative",J.style.overflow="visible",P=document.createElement("div"),P.style.position="absolute",P.style.fontSize="8px",P.style.left=G+"px",P.style.top=I+"px",mxUtils.write(P,p),J.appendChild(P));return J};n.innerText="";if(!H){var U=window.innerWidth||document.documentElement.clientWidth||