Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var z=this.hoverIcons.isResetEvent;this.hoverIcons.isResetEvent=function(Q,Y){return n.isSpaceDown()||z.apply(this,arguments)};this.keydownHandler=mxUtils.bind(this,function(Q){16==Q.which?this.shiftDown=!0:32!=Q.which||y.isEditing()?mxEvent.isConsumed(Q)||27!=Q.keyCode||this.hideDialog(null,!0):(this.spaceDown=!0,this.hoverIcons.reset(),y.container.style.cursor="move",y.isEditing()||mxEvent.getSource(Q)!=y.container||mxEvent.consume(Q))});mxEvent.addListener(document,"keydown",this.keydownHandler);