Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxConstants.HANDLE_STROKECOLOR)};var Da=mxVertexHandler.prototype.createSizerShape;mxVertexHandler.prototype.createSizerShape=function(x,L,P,X){X=L==mxEvent.ROTATION_HANDLE?HoverIcons.prototype.rotationHandle:L==mxEvent.LABEL_HANDLE?this.secondaryHandleImage:X;return Da.apply(this,arguments)};var Ba=mxGraphHandler.prototype.getBoundingBox;mxGraphHandler.prototype.getBoundingBox=function(x){if(null!=x&&1==x.length){var L=this.graph.getModel(),P=L.getParent(x[0]),X=this.graph.getCellGeometry(x[0]);
if(L.isEdge(P)&&null!=X&&X.relative&&(L=this.graph.view.getState(x[0]),null!=L&&2>L.width&&2>L.height&&null!=L.text&&null!=L.text.boundingBox))return mxRectangle.fromRectangle(L.text.boundingBox)}return Ba.apply(this,arguments)};var ya=mxGraphHandler.prototype.getGuideStates;mxGraphHandler.prototype.getGuideStates=function(){for(var x=ya.apply(this,arguments),L=[],P=0;P<x.length;P++)"1"!=mxUtils.getValue(x[P].style,"part","0")&&L.push(x[P]);return L};var Oa=mxVertexHandler.prototype.getSelectionBounds;