Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
q.getSelectionCells(),L=q.getModel();if(2==G.length&&L.isVertex(G[0])&&L.isVertex(G[1])&&2==q.getMovableCells(G).length){var R=q.getCellGeometry(G[0]),V=q.getCellGeometry(G[1]);if(null!=R&&null!=V){R=R.clone();V=V.clone();L.beginUpdate();try{L.setGeometry(G[0],V),L.setGeometry(G[1],R)}finally{L.endUpdate()}}}});this.addAction("copySize",function(){var G=q.getSelectionCell();q.isEnabled()&&null!=G&&q.getModel().isVertex(G)&&(G=q.getCellGeometry(G),null!=G&&(n.copiedSize=new mxRectangle(G.x,G.y,G.width,