Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(G){if(g.isEnabled()&&1==g.getSelectionCount()){var P=g.getSelectionCell(),O=mxEvent.isControlDown(G)?null:g.getIncomingTreeEdges(P);G=[];if(null!=O&&0<O.length&&(O=g.getOutgoingTreeEdges(g.model.getTerminal(O[0],!0)),null!=O))for(var N=0;N<O.length;N++)G.push(g.model.getTerminal(O[N],!1));0==G.length&&(G=g.model.getChildren(g.model.getParent(P)));g.setSelectionCells(G)}},null,null,"Alt+Shift+S");var u=g.removeCells;g.removeCells=function(G,P){P=null!=P?P:!0;null==G&&(G=this.getDeletableCells(this.getSelectionCells()));
P&&(G=this.getDeletableCells(this.addAllEdges(G)));for(var O=[],N=0;N<G.length;N++){var T=G[N];n.isEdge(T)&&l(T)&&(O.push(T),T=n.getTerminal(T,!1));if(c(T)){var m=[];g.traverse(T,!0,function(B,K){var R=null!=K&&g.isTreeEdge(K);R&&m.push(K);(null==K||R)&&m.push(B);return null==K||R});0<m.length&&(O=O.concat(m),T=g.getIncomingTreeEdges(G[N]),G=G.concat(T))}else null!=T&&O.push(G[N])}G=O;return u.apply(this,arguments)};d.hoverIcons.getStateAt=function(G,P,O){return c(G.cell)?null:this.graph.view.getState(this.graph.getCellAt(P,