Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function R(ba,S,da){ba=f.getOutgoingTreeEdges(ba);da=f.view.getState(da);var P=[];if(null!=da&&null!=ba){for(var V=0;V<ba.length;V++){var l=f.view.getState(f.model.getTerminal(ba[V],!1));null!=l&&(!S&&Math.min(l.x+l.width,da.x+da.width)>=Math.max(l.x,da.x)||S&&Math.min(l.y+l.height,da.y+da.height)>=Math.max(l.y,da.y))&&P.push(l)}P.sort(function(B,N){return S?B.x+B.width-N.x-N.width:B.y+B.height-N.y-N.height})}return P}function W(ba,S){var da=M(ba),P=S==mxConstants.DIRECTION_EAST||S==mxConstants.DIRECTION_WEST;
(da==mxConstants.DIRECTION_EAST||da==mxConstants.DIRECTION_WEST)==P&&da!=S?d.actions.get("selectParent").funct():da==S?(S=f.getOutgoingTreeEdges(ba),null!=S&&0<S.length&&f.setSelectionCell(f.model.getTerminal(S[0],!1))):(da=f.getIncomingTreeEdges(ba),null!=da&&0<da.length&&(P=R(f.model.getTerminal(da[0],!0),P,ba),ba=f.view.getState(ba),null!=ba&&(ba=mxUtils.indexOf(P,ba),0<=ba&&(ba+=S==mxConstants.DIRECTION_NORTH||S==mxConstants.DIRECTION_WEST?-1:1,0<=ba&&ba<=P.length-1&&f.setSelectionCell(P[ba].cell)))))}