Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"keydown",mxUtils.bind(this,function(n){this.onKeyDown(n)}));mxEvent.addListener(b.container,"keypress",mxUtils.bind(this,function(n){this.onKeyPress(n)}));this.addUndoListener();this.addBeforeUnloadListener();b.getSelectionModel().addListener(mxEvent.CHANGE,mxUtils.bind(this,function(){this.updateActionStates()}));b.getModel().addListener(mxEvent.CHANGE,mxUtils.bind(this,function(){this.updateActionStates()}));var e=b.setDefaultParent,g=this;this.editor.graph.setDefaultParent=function(){e.apply(this,
arguments);g.updateActionStates()};b.editLink=g.actions.get("editLink").funct;this.updateActionStates();this.initClipboard();this.initCanvas();null!=this.format&&this.format.init()}};EditorUi.prototype.clearSelectionState=function(){this.selectionState=null};EditorUi.prototype.getSelectionState=function(){null==this.selectionState&&(this.selectionState=this.createSelectionState());return this.selectionState};