Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
l,u,p,t){var B=c.view;p=null!=p&&0<p.length?p[0]:null;var D=c.absolutePoints,ha=D[0];D=D[D.length-1];null!=p&&(p=B.transformControlPoint(c,p));null==ha&&null!=l&&(ha=new mxPoint(l.getCenterX(),l.getCenterY()));null==D&&null!=u&&(D=new mxPoint(u.getCenterX(),u.getCenterY()));var I=Bb.x,ua=Bb.y,na=vb.x,Za=vb.y,qb="horizontal"==mxUtils.getValue(c.style,"elbow","horizontal");if(null!=D&&null!=ha){c=function(Ga,Ja,Ia){Ga-=fb.x;var Ha=Ja-fb.y;Ja=(Za*Ga-na*Ha)/(I*Za-ua*na);Ga=(ua*Ga-I*Ha)/(ua*na-I*Za);qb?
(Ia&&(fb=new mxPoint(fb.x+I*Ja,fb.y+ua*Ja),t.push(fb)),fb=new mxPoint(fb.x+na*Ga,fb.y+Za*Ga)):(Ia&&(fb=new mxPoint(fb.x+na*Ga,fb.y+Za*Ga),t.push(fb)),fb=new mxPoint(fb.x+I*Ja,fb.y+ua*Ja));t.push(fb)};var fb=ha;null==p&&(p=new mxPoint(ha.x+(D.x-ha.x)/2,ha.y+(D.y-ha.y)/2));c(p.x,p.y,!0);c(D.x,D.y,!1)}};mxStyleRegistry.putValue("isometricEdgeStyle",mxEdgeStyle.IsometricConnector);var Cb=Graph.prototype.createEdgeHandler;Graph.prototype.createEdgeHandler=function(c,l){if(l==mxEdgeStyle.IsometricConnector){var u=