Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxVertexHandler.prototype.updateLinkHint;var Ea=mxEdgeHandler.prototype.createConstraintHandler;mxEdgeHandler.prototype.createConstraintHandler=function(){var x=Ea.apply(this,arguments);x.isEnabled=mxUtils.bind(this,function(){return this.state.view.graph.connectionHandler.isEnabled()});return x};var za=mxEdgeHandler.prototype.init;mxEdgeHandler.prototype.init=function(){za.apply(this,arguments);var x=mxUtils.bind(this,function(){null!=this.linkHint&&(this.linkHint.style.display=1==this.graph.getSelectionCount()?
"":"none");null!=this.labelShape&&(this.labelShape.node.style.display=this.graph.isEnabled()&&this.graph.getSelectionCount()<this.graph.graphHandler.maxCells?"":"none")});this.changeHandler=mxUtils.bind(this,function(X,ea){this.updateLinkHint(this.graph.getLinkForCell(this.state.cell),this.graph.getLinksForState(this.state));x();this.redrawHandles()});this.graph.getSelectionModel().addListener(mxEvent.CHANGE,this.changeHandler);this.graph.getModel().addListener(mxEvent.CHANGE,this.changeHandler);
var L=this.graph.getLinkForCell(this.state.cell),P=this.graph.getLinksForState(this.state);if(null!=L||null!=P&&0<P.length)this.updateLinkHint(L,P),this.redrawHandles()};var Va=mxConnectionHandler.prototype.init;mxConnectionHandler.prototype.init=function(){Va.apply(this,arguments);this.constraintHandler.isEnabled=mxUtils.bind(this,function(){return this.graph.connectionHandler.isEnabled()})};var La=mxVertexHandler.prototype.redrawHandles;mxVertexHandler.prototype.redrawHandles=function(){if(null!=