Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
B=mxEvent.getClientX(H);u.popupMenuHandler.hideMenu();mxEvent.consume(H)}));mxEvent.addGestureListeners(document.body,null,mxUtils.bind(this,function(H){var ja=!1;null!=B&&(this.diagramContainer.style.width=Math.max(20,M+mxEvent.getClientX(H)-B)+"px",ja=!0);null!=F&&(this.diagramContainer.style.height=Math.max(20,O+mxEvent.getClientY(H)-F)+"px",ja=!0);ja&&((window.opener||window.parent).postMessage(JSON.stringify({event:"resize",fullscreen:Editor.inlineFullscreen,rect:this.diagramContainer.getBoundingClientRect()}),
"*"),this.inlineSizeChanged(),this.refresh())}),function(H){null==B&&null==F||mxEvent.consume(H);F=B=null});document.body.style.backgroundColor="transparent";this.diagramContainer.style.borderRadius="4px";this.bottomResizer.style.visibility="hidden";this.rightResizer.style.visibility="hidden";this.sketchMenubarElt.style.display="none";f.style.visibility="hidden";d.style.visibility="hidden";l.style.display="none";this.addListener("editInlineStart",mxUtils.bind(this,function(H){this.inlineSizeChanged();