Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
parseInt(this.textarea.style.width)*P);this.textarea.style.left=Math.round(this.bounds.x)+"px";this.textarea.style.top=Math.round(this.bounds.y)+"px";mxUtils.setPrefixedStyle(this.textarea.style,"transform","scale("+P+","+P+")")}else this.textarea.style.height="",this.textarea.style.overflow="",J.apply(this,arguments)};mxCellEditorGetInitialValue=mxCellEditor.prototype.getInitialValue;mxCellEditor.prototype.getInitialValue=function(x,L){if("0"==mxUtils.getValue(x.style,"html","0"))return mxCellEditorGetInitialValue.apply(this,
arguments);var P=this.graph.getEditingValue(x.cell,L);"1"==mxUtils.getValue(x.style,"nl2Br","1")&&(P=P.replace(/\n/g,"<br/>"));return P=Graph.sanitizeHtml(P,!0)};mxCellEditorGetCurrentValue=mxCellEditor.prototype.getCurrentValue;mxCellEditor.prototype.getCurrentValue=function(x){if("0"==mxUtils.getValue(x.style,"html","0"))return mxCellEditorGetCurrentValue.apply(this,arguments);var L=Graph.sanitizeHtml(this.textarea.innerHTML,!0);return L="1"==mxUtils.getValue(x.style,"nl2Br","1")?L.replace(/\r\n/g,