Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
F=document.createElement("div");F.style.height="300px";F.style.width="300px";F.style.display="inline-flex";F.style.justifyContent="center";F.style.alignItems="center";F.style.position="absolute";var L=document.createElement("img");L.onload=function(){function A(){H.model.setStyle(c,e+u())}H=new Graph(N);H.autoExtend=!1;H.autoScroll=!1;H.setGridEnabled(!1);H.setEnabled(!0);H.setPanning(!1);H.setConnectable(!1);H.getRubberband().setEnabled(!1);H.graphHandler.allowLivePreview=!1;var S=H.createVertexHandler;
H.createVertexHandler=function(){var Q=S.apply(this,arguments);Q.livePreview=!1;return Q};if(null!=m)try{if("inset"==m.substring(0,5)){var l=c.geometry,n=L.width,z=L.height,C=(300-n)/2,D=(300-z)/2,M=m.match(/\(([^)]+)\)/)[1].split(/[ ,]+/),K=parseFloat(M[0]),O=parseFloat(M[1]),V=parseFloat(M[2]),k=parseFloat(M[3]);isFinite(K)&&isFinite(O)&&isFinite(V)&&isFinite(k)?(l.x=k/100*n+C,l.y=K/100*z+D,l.width=(100-O)/100*n+C-l.x,l.height=(100-V)/100*z+D-l.y,"round"==M[4]?"50%"==M[5]?p.setAttribute("checked",
"checked"):(J=parseInt(M[5]),x.value=J,q.setAttribute("checked","checked"),t.style.visibility="visible"):g.setAttribute("checked","checked")):m=null}else m=null}catch(Q){}c.style=e+(m?m:u());c.vertex=!0;H.addCell(c,null,null,null,null);H.selectAll();H.addListener(mxEvent.CELLS_MOVED,A);H.addListener(mxEvent.CELLS_RESIZED,A);var y=H.graphHandler.mouseUp,G=H.graphHandler.mouseDown;H.graphHandler.mouseUp=function(){y.apply(this,arguments);N.style.backgroundColor="#fff9"};H.graphHandler.mouseDown=function(){G.apply(this,
arguments);N.style.backgroundColor=""};H.dblClick=function(){};var P=H.getSelectionModel().changeSelection;H.getSelectionModel().changeSelection=function(){P.call(this,[c],[c])}};L.onerror=function(){L.onload=null;L.src=Editor.errorImage};L.setAttribute("src",f);L.style.maxWidth="300px";L.style.maxHeight="300px";F.appendChild(L);E.appendChild(F);var N=document.createElement("div");N.style.width="300px";N.style.height="300px";N.style.overflow="hidden";N.style.backgroundColor="#fff9";E.appendChild(N);