Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph=function(b,e,g,n,y,q){mxGraph.call(this,b,e,g,n);this.themes=y||this.defaultThemes;this.currentEdgeStyle=mxUtils.clone(this.defaultEdgeStyle);this.currentVertexStyle=mxUtils.clone(this.defaultVertexStyle);this.standalone=null!=q?q:!1;b=this.baseUrl;e=b.indexOf("//");this.domainPathUrl=this.domainUrl="";0<e&&(e=b.indexOf("/",e+2),0<e&&(this.domainUrl=b.substring(0,e)),e=b.lastIndexOf("/"),0<e&&(this.domainPathUrl=b.substring(0,e+1)));this.isHtmlLabel=function(S){S=this.getCurrentCellStyle(S);
return null!=S?"1"==S.html||"wrap"==S[mxConstants.STYLE_WHITE_SPACE]:!1};if(this.immediateHandling){var E=null,N=null,T=null,F=null,K=!1;this.addListener(mxEvent.FIRE_MOUSE_EVENT,mxUtils.bind(this,function(S,U){if("mouseDown"==U.getProperty("eventName")&&this.isEnabled()){S=U.getProperty("event");var Q=S.getState();U=this.view.scale;if(!mxEvent.isAltDown(S.getEvent())&&null!=Q&&!this.panningHandler.isActive()&&!mxEvent.isControlDown(S.getEvent())){var Y=this.selectionCellsHandler.getHandler(Q.cell);