Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
[mxConstants.DIRECTION_EAST,mxConstants.DIRECTION_SOUTH,mxConstants.DIRECTION_WEST,mxConstants.DIRECTION_NORTH],Pa=mxUtils.getValue(lb.style,mxConstants.STYLE_DIRECTION,mxConstants.DIRECTION_EAST);this.setCellStyles(mxConstants.STYLE_DIRECTION,kb[mxUtils.mod(mxUtils.indexOf(kb,Pa)+(L?-1:1),kb.length)],[la])}X.push(la)}}}finally{P.endUpdate()}return X};Graph.prototype.stencilHasPlaceholders=function(x){if(null!=x&&null!=x.fgNode)for(x=x.fgNode.firstChild;null!=x;){if("text"==x.nodeName&&"1"==x.getAttribute("placeholders"))return!0;
x=x.nextSibling}return!1};var f=Graph.prototype.processChange;Graph.prototype.processChange=function(x){if(x instanceof mxGeometryChange&&(this.isTableCell(x.cell)||this.isTableRow(x.cell))&&(null==x.previous&&null!=x.geometry||null!=x.previous&&!x.previous.equals(x.geometry))){var L=x.cell;this.isTableCell(L)&&(L=this.model.getParent(L));this.isTableRow(L)&&(L=this.model.getParent(L));var P=this.view.getState(L);null!=P&&null!=P.shape&&(this.view.invalidate(L),P.shape.bounds=null)}f.apply(this,arguments);