Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Actions.prototype.init=function(){function b(G){q.escape();G=q.deleteCells(q.getDeletableCells(q.getSelectionCells()),G);null!=G&&q.setSelectionCells(G)}function e(){if(!q.isSelectionEmpty()){q.getModel().beginUpdate();try{for(var G=q.getSelectionCells(),L=0;L<G.length;L++)q.cellLabelChanged(G[L],"")}finally{q.getModel().endUpdate()}}}function g(G,L,R,V,d){d.getModel().beginUpdate();try{var f=d.getCellGeometry(G);null!=f&&R&&V&&(R/=V,f=f.clone(),1<R?f.height=f.width/R:f.width=f.height*R,d.getModel().setGeometry(G,