Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null!=va&&va.relative&&0>=va.x&&this.model.remove(Fa[L]);var Ua=this.model.getTerminal(P,!1);if(null!=Ua){var ab=this.getCurrentCellStyle(Ua);null!=ab&&"1"==ab.snapToPoint&&(this.setCellStyles(mxConstants.STYLE_EXIT_X,null,[x]),this.setCellStyles(mxConstants.STYLE_EXIT_Y,null,[x]),this.setCellStyles(mxConstants.STYLE_ENTRY_X,null,[P]),this.setCellStyles(mxConstants.STYLE_ENTRY_Y,null,[P]))}}finally{this.model.endUpdate()}return P};var R=Graph.prototype.selectCell;Graph.prototype.selectCell=function(x,
L,P){if(L||P)R.apply(this,arguments);else{var X=this.getSelectionCell(),ea=null,la=[],oa=mxUtils.bind(this,function(xa){if(null!=this.view.getState(xa)&&(this.model.isVertex(xa)||this.model.isEdge(xa)))if(la.push(xa),xa==X)ea=la.length-1;else if(x&&null==X&&0<la.length||null!=ea&&x&&la.length>ea||!x&&0<ea)return;for(var sa=0;sa<this.model.getChildCount(xa);sa++)oa(this.model.getChildAt(xa,sa))});oa(this.model.root);0<la.length&&(ea=null!=ea?mxUtils.mod(ea+(x?1:-1),la.length):0,this.setSelectionCell(la[ea]))}};