Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
J.translate(Math.floor((1-q.x)/C),Math.floor((1-q.y)/C));J.scale(1/C);var P=0,O=J.save;J.save=function(){P++;O.apply(this,arguments)};var N=J.restore;J.restore=function(){P--;N.apply(this,arguments)};var T=p.drawShape;p.drawShape=function(m){mxLog.debug("entering shape",m,P);T.apply(this,arguments);mxLog.debug("leaving shape",m,P)};p.drawState(k.getView().getState(k.model.root),J);mxLog.show();mxLog.debug(mxUtils.getXml(G));mxLog.debug("stateCounter",P)}));c.actions.addAction("testShowConsole",function(){mxLog.isVisible()?