Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var F=y.cellEditor.isStopEditingEvent;y.cellEditor.isStopEditingEvent=function(P){return F.apply(this,arguments)||13==P.keyCode&&(!mxClient.IS_SF&&mxEvent.isControlDown(P)||mxClient.IS_MAC&&mxEvent.isMetaDown(P)||mxClient.IS_SF&&mxEvent.isShiftDown(P))};var M=y.isZoomWheelEvent;y.isZoomWheelEvent=function(){return n.isSpaceDown()||M.apply(this,arguments)};var O=!1,H=null,ja=null,da=null,ca=mxUtils.bind(this,function(){if(null!=this.toolbar&&O!=y.cellEditor.isContentEditing()){for(var P=this.toolbar.container.firstChild,