Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
v.x,v.y),b.editor.graph.fireEvent(new mxEventObject("cellsInserted","cells",n))}finally{b.editor.graph.getModel().endUpdate()}b.editor.graph.setSelectionCells(n);b.editor.graph.scrollCellToVisible(b.editor.graph.getSelectionCell());t.destroy();q.parentNode.removeChild(q)}}}function u(){return"list"==F.value?"Person\n-name: String\n-birthDate: Date\n--\n+getName(): String\n+setName(String): void\n+isBirthday(): boolean\n\nAddress\n-street: String\n-city: String\n-state: String":"mermaid"==F.value||
"mermaid2drawio"==F.value?"graph TD;\n  A--\x3eB;\n  A--\x3eC;\n  B--\x3eD;\n  C--\x3eD;":"table"==F.value?"CREATE TABLE Suppliers\n(\nsupplier_id int NOT NULL PRIMARY KEY,\nsupplier_name char(50) NOT NULL,\ncontact_name char(50),\n);\nCREATE TABLE Customers\n(\ncustomer_id int NOT NULL PRIMARY KEY,\ncustomer_name char(50) NOT NULL,\naddress char(50),\ncity char(50),\nstate char(25),\nzip_code char(10)\n);\n":"plantUmlPng"==F.value?"@startuml\nskinparam backgroundcolor transparent\nskinparam shadowing false\nAlice -> Bob: Authentication Request\nBob --\x3e Alice: Authentication Response\n\nAlice -> Bob: Another authentication Request\nAlice <-- Bob: Another authentication Response\n@enduml":
"plantUmlSvg"==F.value||"plantUmlTxt"==F.value?"@startuml\nskinparam shadowing false\nAlice -> Bob: Authentication Request\nBob --\x3e Alice: Authentication Response\n\nAlice -> Bob: Another authentication Request\nAlice <-- Bob: Another authentication Response\n@enduml":";Example:\na->b\nb->edge label->c\nc->a\n"}var v=b.editor.graph.getFreeInsertPoint();f=document.createElement("div");f.style.textAlign="right";var E=document.createElement("textarea");E.style.boxSizing="border-box";E.style.resize=