Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
t=mxEvent.getClientX(A);q.popupMenuHandler.hideMenu();mxEvent.consume(A)}));mxEvent.addGestureListeners(document.body,null,mxUtils.bind(this,function(A){var S=!1;null!=t&&(this.diagramContainer.style.width=Math.max(20,B+mxEvent.getClientX(A)-t)+"px",S=!0);null!=x&&(this.diagramContainer.style.height=Math.max(20,I+mxEvent.getClientY(A)-x)+"px",S=!0);S&&((window.opener||window.parent).postMessage(JSON.stringify({event:"resize",fullscreen:Editor.inlineFullscreen,rect:this.diagramContainer.getBoundingClientRect()}),
"*"),this.inlineSizeChanged(),this.refresh())}),function(A){null==t&&null==x||mxEvent.consume(A);x=t=null});document.body.style.backgroundColor="transparent";this.diagramContainer.style.borderRadius="4px";this.bottomResizer.style.visibility="hidden";this.rightResizer.style.visibility="hidden";this.sketchMenubarElt.style.display="none";e.style.visibility="hidden";c.style.visibility="hidden";g.style.display="none";this.addListener("editInlineStart",mxUtils.bind(this,function(A){this.inlineSizeChanged();