Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
arguments);var P=this.graph.getEditingValue(x.cell,L);"1"==mxUtils.getValue(x.style,"nl2Br","1")&&(P=P.replace(/\n/g,"<br/>"));return P=Graph.sanitizeHtml(P,!0)};mxCellEditorGetCurrentValue=mxCellEditor.prototype.getCurrentValue;mxCellEditor.prototype.getCurrentValue=function(x){if("0"==mxUtils.getValue(x.style,"html","0"))return mxCellEditorGetCurrentValue.apply(this,arguments);var L=Graph.sanitizeHtml(this.textarea.innerHTML,!0);return L="1"==mxUtils.getValue(x.style,"nl2Br","1")?L.replace(/\r\n/g,
"<br/>").replace(/\n/g,"<br/>"):L.replace(/\r\n/g,"").replace(/\n/g,"")};var O=mxCellEditor.prototype.stopEditing;mxCellEditor.prototype.stopEditing=function(x){this.codeViewMode&&this.toggleViewMode();O.apply(this,arguments);this.focusContainer()};mxCellEditor.prototype.focusContainer=function(){try{this.graph.container.focus()}catch(x){}};var G=mxCellEditor.prototype.applyValue;mxCellEditor.prototype.applyValue=function(x,L){this.graph.getModel().beginUpdate();try{G.apply(this,arguments),""==L&&