Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"keys",Da,"values",Ta,"cells",ca.getSelectionCells()))}finally{ca.getModel().endUpdate()}}function Q(pa,ua,va){var Ea=mxUtils.getOffset(k,!0),Da=mxUtils.getOffset(pa,!0);ua.style.position="absolute";ua.style.left=Da.x-Ea.x+"px";ua.style.top=Da.y-Ea.y+"px";ua.style.width=pa.offsetWidth+"px";ua.style.height=pa.offsetHeight-(va?4:0)+"px";ua.style.zIndex=5}function U(pa,ua,va){var Ea=document.createElement("div");Ea.style.width="32px";Ea.style.height="4px";Ea.style.margin="2px";Ea.style.border="1px solid black";