Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
y.popupMenuHandler.autoExpand=!0;null!=this.menus&&(y.popupMenuHandler.factoryMethod=mxUtils.bind(this,function(Q,Y,m){this.menus.createPopupMenu(Q,Y,m)}));mxEvent.addGestureListeners(document,mxUtils.bind(this,function(Q){y.popupMenuHandler.hideMenu()}));this.keyHandler=this.createKeyHandler(b);this.getKeyHandler=function(){return keyHandler};y.connectionHandler.addListener(mxEvent.CONNECT,function(Q,Y){var m=[Y.getProperty("cell")];Y.getProperty("terminalInserted")&&(m.push(Y.getProperty("terminal")),