Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(x){var L=x.getEvent();return null==x.getState()&&!mxEvent.isMouseEvent(L)||mxEvent.isPopupTrigger(L)&&(null==x.getState()||mxEvent.isControlDown(L)||mxEvent.isShiftDown(L))};var aa=mxGraphHandler.prototype.mouseDown;mxGraphHandler.prototype.mouseDown=function(x,L){aa.apply(this,arguments);mxEvent.isTouchEvent(L.getEvent())&&this.graph.isCellSelected(L.getCell())&&1<this.graph.getSelectionCount()&&(this.delayedSelection=!1)}}else mxPanningHandler.prototype.isPanningTrigger=function(x){var L=