Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.graph.getSelectionCells()),this.graph.graphHandler.cellWasClicked=!0,this.graph.isMouseTrigger=mxEvent.isMouseEvent(oa),this.graph.isMouseDown=!0);mxEvent.consume(oa)}),null,mxUtils.bind(this,function(oa){mxEvent.isPopupTrigger(oa)&&(this.graph.popupMenuHandler.popup(mxEvent.getClientX(oa),mxEvent.getClientY(oa),ea.cell,oa),mxEvent.consume(oa))}));P.push(la)}else P.push(null)})(this.graph.view.getState(L.getChildAt(this.state.cell,X)));return P};mxVertexHandler.prototype.destroyMoveHandles=function(){if(null!=
this.moveHandles){for(var x=0;x<this.moveHandles.length;x++)null!=this.moveHandles[x]&&this.moveHandles[x].destroy();this.moveHandles=null}};var M=mxVertexHandler.prototype.refresh;mxVertexHandler.prototype.refresh=function(){M.apply(this,arguments);this.graph.isTable(this.state.cell)&&this.graph.isCellMovable(this.state.cell)&&this.refreshMoveHandles()};var ba=mxVertexHandler.prototype.getHandlePadding;mxVertexHandler.prototype.getHandlePadding=function(){var x=new mxPoint(0,0),L=this.tolerance,