Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.showShapePicker=function(b,e,g,n,y,q,E,N,T){N=N||null==g;b=this.createShapePicker(b,e,g,n,y,mxUtils.bind(this,function(){this.hideShapePicker()}),this.getCellsForShapePicker(g,q,N),q,E,N,T);null!=b&&(null==this.hoverIcons||q||this.hoverIcons.reset(),q=this.editor.graph,q.popupMenuHandler.hideMenu(),q.tooltipHandler.hideTooltip(),this.hideCurrentMenu(),this.hideShapePicker(),this.shapePickerCallback=n,this.shapePicker=b);return b};