Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!1;Ra.setPosition=function(Pa,eb,jb){lb=Math.max(Graph.minTableRowHeight-Pa.height,eb.y-Pa.y-Pa.height);kb=mxEvent.isShiftDown(jb.getEvent());null!=db&&kb&&(lb=Math.min(lb,db.height-Graph.minTableRowHeight))};Ra.execute=function(Pa){if(0!=lb)X.setTableRowHeight(this.state.cell,lb,!kb);else if(!P.blockDelayedSelection){var eb=X.getCellAt(Pa.getGraphX(),Pa.getGraphY())||oa.cell;X.graphHandler.selectCellForEvent(eb,Pa)}lb=0};Ra.reset=function(){lb=0}}x.push(Ra)})(ea);for(ea=0;ea<Ua.length;ea++)mxUtils.bind(this,