Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.addListener(mxEvent.START_EDITING,function(la,oa){this.popupMenuHandler.hideMenu()});var x=this.updateMouseEvent;this.updateMouseEvent=function(la){la=x.apply(this,arguments);if(mxEvent.isTouchEvent(la.getEvent())&&null==la.getState()){var oa=this.getCellAt(la.graphX,la.graphY);null!=oa&&this.isSwimlane(oa)&&this.hitsSwimlaneContent(oa,la.graphX,la.graphY)||(la.state=this.view.getState(oa),null!=la.state&&null!=la.state.shape&&(this.container.style.cursor=la.state.shape.node.style.cursor))}null==
la.getState()&&this.isEnabled()&&(this.container.style.cursor="default");return la};var L=!1,P=!1,X=!1,ea=this.fireMouseEvent;this.fireMouseEvent=function(la,oa,xa){la==mxEvent.MOUSE_DOWN&&(oa=this.updateMouseEvent(oa),L=this.isCellSelected(oa.getCell()),P=this.isSelectionEmpty(),X=this.popupMenuHandler.isMenuShowing());ea.apply(this,arguments)};this.popupMenuHandler.mouseUp=mxUtils.bind(this,function(la,oa){var xa=mxEvent.isMouseEvent(oa.getEvent());this.popupMenuHandler.popupTrigger=!this.isEditing()&&