Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
if(L.isEdge(P)&&null!=X&&X.relative&&(L=this.graph.view.getState(x[0]),null!=L&&2>L.width&&2>L.height&&null!=L.text&&null!=L.text.boundingBox))return mxRectangle.fromRectangle(L.text.boundingBox)}return Ba.apply(this,arguments)};var ya=mxGraphHandler.prototype.getGuideStates;mxGraphHandler.prototype.getGuideStates=function(){for(var x=ya.apply(this,arguments),L=[],P=0;P<x.length;P++)"1"!=mxUtils.getValue(x[P].style,"part","0")&&L.push(x[P]);return L};var Oa=mxVertexHandler.prototype.getSelectionBounds;