Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"cells",[E])),b.fireEvent(new mxEventObject("freehandInserted","cell",E))}finally{b.model.endUpdate()}q&&b.setSelectionCells([E])}}for(E=0;E<u.length;E++)u[E].parentNode.removeChild(u[E]);d=null;u=[];D=[]}x(!1)};b.addListener(mxEvent.FIRE_MOUSE_EVENT,mxUtils.bind(this,function(z,E){z=E.getProperty("eventName");E=E.getProperty("event");z==mxEvent.MOUSE_MOVE&&e&&(null!=E.sourceState&&E.sourceState.setCursor("crosshair"),E.consume())}));b.addMouseListener({mouseDown:mxUtils.bind(this,function(z,E){if(b.isEnabled()&&
!b.isCellLocked(b.getDefaultParent())&&(z=E.getEvent(),e&&!mxEvent.isPopupTrigger(z)&&!mxEvent.isMultiTouchEvent(z))){var A=parseFloat(b.currentVertexStyle[mxConstants.STYLE_STROKEWIDTH]||1);A=Math.max(1,A*b.view.scale);var N=B();d=document.createElementNS("http://www.w3.org/2000/svg","path");d.setAttribute("fill",t?N:"none");d.setAttribute("stroke",N);d.setAttribute("stroke-width",A);"1"==b.currentVertexStyle[mxConstants.STYLE_DASHED]&&(N=b.currentVertexStyle[mxConstants.STYLE_DASH_PATTERN]||"3 3",
N=N.split(" ").map(function(Q){return parseFloat(Q)*A}).join(" "),d.setAttribute("stroke-dasharray",N));c=[];z=T(z);l(z);v="M"+z.x+" "+z.y;D.push(z);F=[];d.setAttribute("d",t?PerfectFreehand.getSvgPathFromStroke([[z.x,z.y]],p):v);f.appendChild(d);E.consume()}}),mouseMove:mxUtils.bind(this,function(z,E){if(d&&b.isEnabled()&&!b.isCellLocked(b.getDefaultParent())){z=E.getEvent();z=T(z);l(z);var A=n(0);if(A)if(D.push(A),t){var N=[];for(A=0;A<D.length;A++)N.push([D[A].x,D[A].y]);F=[];for(var Q=2;Q<c.length;Q+=