Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
sa))}}finally{this.graph.model.endUpdate()}}else oa=new mxRectangle(this.x,this.y,this.width,this.height),this.graph.selectRegion(oa,L.getEvent());L.consume()}}};mxRubberband.prototype.mouseMove=function(x,L){if(!L.isConsumed()&&null!=this.first){var P=mxUtils.getScrollOrigin(this.graph.container);x=mxUtils.getOffset(this.graph.container);P.x-=x.x;P.y-=x.y;x=L.getX()+P.x;P=L.getY()+P.y;var X=this.first.x-x,ea=this.first.y-P,la=this.graph.tolerance;if(null!=this.div||Math.abs(X)>la||Math.abs(ea)>la)null==