Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
0;T<G.length;T++){var m=g.view.getState(g.model.getTerminal(G[T],!1));null!=m&&(!P&&Math.min(m.x+m.width,O.x+O.width)>=Math.max(m.x,O.x)||P&&Math.min(m.y+m.height,O.y+O.height)>=Math.max(m.y,O.y))&&N.push(m)}N.sort(function(B,K){return P?B.x+B.width-K.x-K.width:B.y+B.height-K.y-K.height})}return N}function I(G,P){var O=y(G),N=P==mxConstants.DIRECTION_EAST||P==mxConstants.DIRECTION_WEST;(O==mxConstants.DIRECTION_EAST||O==mxConstants.DIRECTION_WEST)==N&&O!=P?d.actions.get("selectParent").funct():O==
P?(P=g.getOutgoingTreeEdges(G),null!=P&&0<P.length&&g.setSelectionCell(g.model.getTerminal(P[0],!1))):(O=g.getIncomingTreeEdges(G),null!=O&&0<O.length&&(N=M(g.model.getTerminal(O[0],!0),N,G),G=g.view.getState(G),null!=G&&(G=mxUtils.indexOf(N,G),0<=G&&(G+=P==mxConstants.DIRECTION_NORTH||P==mxConstants.DIRECTION_WEST?-1:1,0<=G&&G<=N.length-1&&g.setSelectionCell(N[G].cell)))))}var d=this,g=d.editor.graph,n=g.getModel(),t=d.menus.createPopupMenu;d.menus.createPopupMenu=function(G,P,O){t.apply(this,arguments);