EditorUi.prototype.updateCssForMarker = function(markerDiv, prefix, shape, marker, fill)
{
	markerDiv.style.verticalAlign = 'top';
	markerDiv.style.height = '21px';
	markerDiv.style.width = '21px';
	markerDiv.innerHTML = '';

	if (shape == 'flexArrow')
	{
		markerDiv.className = (marker != null && marker != mxConstants.NONE) ?
			'geSprite geSprite-' + prefix + 'blocktrans' : 'geSprite geSprite-noarrow';
	}
	else
	{
		var src = this.getImageForMarker(marker, fill);

		if (src != null)
		{
			var img = document.createElement('img');
			img.style.position = 'absolute';
			img.style.marginTop = '0.5px';
			img.setAttribute('src', src);
			markerDiv.className = '';

			if (prefix == 'end')
			{
				mxUtils.setPrefixedStyle(img.style, 'transform', 'scaleX(-1)');
			}
			
			if (Editor.isDarkMode())
			{
				img.style.filter = 'invert(100%)';
			}	

			markerDiv.appendChild(img);
		}
		else
		{
			markerDiv.className = 'geSprite geSprite-noarrow';
			markerDiv.innerHTML = mxUtils.htmlEntities(mxResources.get('none'));
			markerDiv.style.backgroundImage = 'none';
			markerDiv.style.verticalAlign = 'top';
			markerDiv.style.marginTop = '4px';
			markerDiv.style.fontSize = '10px';
			markerDiv.style.filter = 'none';
			markerDiv.style.color = this.defaultStrokeColor;
			markerDiv.nextSibling.style.marginTop = '0px';
		}
	}
};
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.