Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
H);X.setAttribute("NameU","Shape"+H);X.setAttribute("LineStyle","0");X.setAttribute("FillStyle","0");X.setAttribute("TextStyle","0");H=K.width/2;var T=K.height/2;X.appendChild(g("PinX",K.x+H+(ha?0:O.shiftX),Q));X.appendChild(g("PinY",R-K.y-T-(ha?0:O.shiftY),Q));X.appendChild(g("Width",K.width,Q));X.appendChild(g("Height",K.height,Q));X.appendChild(g("LocPinX",H,Q));X.appendChild(g("LocPinY",T,Q));X.appendChild(b("LayerMember",P+"",Q));return X}function f(H,K){H=J.ARROWS_MAP[(null==H?"none":H)+"|"+
(null==K?"1":K)];return null!=H?H:1}function k(H){return null==H?2:2>=H?0:3>=H?1:5>=H?2:7>=H?3:9>=H?4:22>=H?5:6}function n(H,K,P,Q,R,ha){var X=P.view.getState(H,!0);if(null==X||null==X.absolutePoints||null==X.cellBounds)return null;P=A(Q,J.XMLNS,"Shape");var T=B(H.id);P.setAttribute("ID",T);P.setAttribute("NameU","Dynamic connector."+T);P.setAttribute("Name","Dynamic connector."+T);P.setAttribute("Type","Shape");P.setAttribute("Master","4");var V=O.state;T=X.absolutePoints;var oa=X.cellBounds,ca=