Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
k[1].geometry.width)/2:(Q.x+Q.width)/T-U.x+-y.x+10,k[1].geometry.y-=k[1].geometry.height+y.y+40):(k[1].geometry.x=V==mxConstants.DIRECTION_WEST?k[1].geometry.x-(k[1].geometry.width+y.x+40):k[1].geometry.x+(k[1].geometry.width-y.x+40),k[1].geometry.y=null==Q?D.geometry.y+(D.geometry.height-k[1].geometry.height)/2:(Q.y+Q.height)/T-U.y+-y.y+10);return e.addCells(k,K)}finally{e.model.endUpdate()}}function R(D,M,K){D=e.getOutgoingTreeEdges(D);K=e.view.getState(K);var O=[];if(null!=K&&null!=D){for(var V=
0;V<D.length;V++){var k=e.view.getState(e.model.getTerminal(D[V],!1));null!=k&&(!M&&Math.min(k.x+k.width,K.x+K.width)>=Math.max(k.x,K.x)||M&&Math.min(k.y+k.height,K.y+K.height)>=Math.max(k.y,K.y))&&O.push(k)}O.sort(function(y,G){return M?y.x+y.width-G.x-G.width:y.y+y.height-G.y-G.height})}return O}function J(D,M){var K=F(D),O=M==mxConstants.DIRECTION_EAST||M==mxConstants.DIRECTION_WEST;(K==mxConstants.DIRECTION_EAST||K==mxConstants.DIRECTION_WEST)==O&&K!=M?c.actions.get("selectParent").funct():K==