Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
P?(P=g.getOutgoingTreeEdges(G),null!=P&&0<P.length&&g.setSelectionCell(g.model.getTerminal(P[0],!1))):(O=g.getIncomingTreeEdges(G),null!=O&&0<O.length&&(N=M(g.model.getTerminal(O[0],!0),N,G),G=g.view.getState(G),null!=G&&(G=mxUtils.indexOf(N,G),0<=G&&(G+=P==mxConstants.DIRECTION_NORTH||P==mxConstants.DIRECTION_WEST?-1:1,0<=G&&G<=N.length-1&&g.setSelectionCell(N[G].cell)))))}var d=this,g=d.editor.graph,n=g.getModel(),t=d.menus.createPopupMenu;d.menus.createPopupMenu=function(G,P,O){t.apply(this,arguments);
if(1==g.getSelectionCount()){P=g.getSelectionCell();var N=g.getOutgoingTreeEdges(P);G.addSeparator();0<N.length&&(c(g.getSelectionCell())&&this.addMenuItems(G,["selectChildren"],null,O),this.addMenuItems(G,["selectDescendants"],null,O));c(g.getSelectionCell())?(G.addSeparator(),0<g.getIncomingTreeEdges(P).length&&this.addMenuItems(G,["selectSiblings","selectParent"],null,O)):0<g.model.getEdgeCount(P)&&this.addMenuItems(G,["selectConnections"],null,O)}};d.actions.addAction("selectChildren",function(G){if(g.isEnabled()&&