Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!0)}}finally{U.endUpdate()}return k}}var O={67:d.actions.get("selectChildren"),88:d.actions.get("selectDescendants"),80:d.actions.get("selectParent"),83:d.actions.get("selectSiblings")},H=d.onKeyDown;d.onKeyDown=function(aa){try{var la=f.getSelectionCell();if(f.isEnabled()&&!f.isEditing()&&null!=la){var X=mxEvent.isAltDown(aa)&&mxEvent.isShiftDown(aa)?O[aa.keyCode]:null;null!=X?(X.funct(aa),mxEvent.consume(aa)):n(la)&&(X=null,0<f.getIncomingTreeEdges(la).length&&(9==aa.which?X=mxEvent.isShiftDown(aa)?
G(la):L(la):13==aa.which&&(X=S(la,!mxEvent.isShiftDown(aa)))),null!=X&&0<X.length?(1==X.length&&f.model.isEdge(X[0])?f.setSelectionCell(f.model.getTerminal(X[0],!1)):f.setSelectionCell(X[X.length-1]),null!=d.hoverIcons&&d.hoverIcons.update(f.view.getState(la)),f.startEditingAtCell(la),mxEvent.consume(aa)):37==aa.keyCode?(V(la,mxConstants.DIRECTION_WEST),mxEvent.consume(aa)):38==aa.keyCode?(V(la,mxConstants.DIRECTION_NORTH),mxEvent.consume(aa)):39==aa.keyCode?(V(la,mxConstants.DIRECTION_EAST),mxEvent.consume(aa)):
40==aa.keyCode&&(V(la,mxConstants.DIRECTION_SOUTH),mxEvent.consume(aa)))}}catch(P){d.handleError(P)}mxEvent.isConsumed(aa)||H.apply(this,arguments)};var ja=f.connectVertex;f.connectVertex=function(aa,la,X,P,U,k,z){var J=f.getIncomingTreeEdges(aa);if(n(aa)){var W=K(aa),T=W==mxConstants.DIRECTION_EAST||W==mxConstants.DIRECTION_WEST,Z=la==mxConstants.DIRECTION_EAST||la==mxConstants.DIRECTION_WEST;return W==la||0==J.length?L(aa,la):T==Z?G(aa):S(aa,la!=mxConstants.DIRECTION_NORTH&&la!=mxConstants.DIRECTION_WEST)}return ja.apply(this,