Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
R.height=n.copiedSize.height,q.getModel().setGeometry(F[K],R))}}finally{q.getModel().endUpdate()}}},null,null,"Alt+Shift+V");this.addAction("copyData",function(){var F=q.getSelectionCell()||q.getModel().getRoot();q.isEnabled()&&null!=F&&(F=F.cloneValue(),null==F||isNaN(F.nodeType)||(n.copiedValue=F))},null,null,"Alt+Shift+B");this.addAction("pasteData",function(F,K){function R(f,k){var v=W.getValue(f);k=f.cloneValue(k);k.removeAttribute("placeholders");null==v||isNaN(v.nodeType)||k.setAttribute("placeholders",
v.getAttribute("placeholders"));null!=F&&mxEvent.isShiftDown(F)||k.setAttribute("label",q.convertValueToString(f));W.setValue(f,k)}F=null!=K?K:F;var W=q.getModel();if(q.isEnabled()&&!q.isSelectionEmpty()&&null!=n.copiedValue){W.beginUpdate();try{var d=q.getEditableCells(q.getSelectionCells());if(0==d.length)R(W.getRoot(),n.copiedValue);else for(K=0;K<d.length;K++)R(d[K],n.copiedValue)}finally{W.endUpdate()}}},null,null,"Alt+Shift+E");this.addAction("delete",function(F,K){F=null!=K?K:F;null!=F&&mxEvent.isShiftDown(F)?