Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(x){if(null!=this.pBounds&&(null!=this.shape||this.livePreviewActive)){null==this.hint&&(this.hint=b(),this.graph.container.appendChild(this.hint));var L=this.graph.view.translate,P=this.graph.view.scale;x=this.roundLength((this.bounds.x+this.currentDx)/P-L.x);L=this.roundLength((this.bounds.y+this.currentDy)/P-L.y);P=this.graph.view.unit;this.hint.innerHTML=e(x,P)+", "+e(L,P);this.hint.style.left=this.pBounds.x+this.currentDx+Math.round((this.pBounds.width-this.hint.clientWidth)/2)+"px";
this.hint.style.top=this.pBounds.y+this.currentDy+this.pBounds.height+Editor.hintOffset+"px"}};mxGraphHandler.prototype.removeHint=function(){null!=this.hint&&(this.hint.parentNode.removeChild(this.hint),this.hint=null)};var ja=mxStackLayout.prototype.resizeCell;mxStackLayout.prototype.resizeCell=function(x,L){ja.apply(this,arguments);var P=this.graph.getCellStyle(x);if(null==P.childLayout){var X=this.graph.model.getParent(x),ea=null!=X?this.graph.getCellGeometry(X):null;if(null!=ea&&(P=this.graph.getCellStyle(X),