Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.dblClick=function(x,L){this.isEnabled()&&(L=this.insertTextForEvent(x,L),mxGraph.prototype.dblClick.call(this,x,L))};Graph.prototype.insertTextForEvent=function(x,L){var P=mxUtils.convertPoint(this.container,mxEvent.getClientX(x),mxEvent.getClientY(x));if(null!=x&&!this.model.isVertex(L)){var X=this.model.isEdge(L)?this.view.getState(L):null,ea=mxEvent.getSource(x);this.firstClickState!=X||this.firstClickSource!=ea||null!=X&&null!=X.text&&null!=X.text.node&&null!=X.text.boundingBox&&