Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxVsdxCanvas2D.prototype.newEdge=function(h,y,A){this.shape=h;this.cellState=y;this.xmGeo=y.cellBounds;this.xmlDoc=A};mxVsdxCanvas2D.prototype.endShape=function(){null!=this.shapeImg&&this.addForeignData(this.shapeImg.type,this.shapeImg.id)};mxVsdxCanvas2D.prototype.newPage=function(){this.images=[]};mxVsdxCanvas2D.prototype.getShapeType=function(){return this.shapeType};mxVsdxCanvas2D.prototype.getShapeGeo=function(){return this.geoSec};