Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.patchPage=function(b,f,m,d){var u=b==this.currentPage?this.editor.graph.model:new mxGraphModel(b.root),v=this.createParentLookup(u,f);u.beginUpdate();try{var E=u.updateEdgeParent,F=new mxDictionary,L=[];u.updateEdgeParent=function(q,p){!F.get(q)&&d&&(F.put(q,!0),L.push(q))};var N=v[""],H=null!=N&&null!=N.inserted?N.inserted[""]:null,R=null;null!=H&&(R=this.getCellForJson(H));if(null==R){var J=null!=N&&null!=N.moved?N.moved[""]:null;null!=J&&(R=u.getCell(J))}null!=R&&(u.setRoot(R),