Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
J.vertex=!0;R.addCell(J);R.dblClick=function(C,D){if(null!=D&&D!=J)R.setSelectionCell(D);else{D=mxUtils.convertPoint(R.container,mxEvent.getClientX(C),mxEvent.getClientY(C));mxEvent.consume(C);C=R.view.scale;var M=R.view.translate;R.setSelectionCell(v((D.x-3*C)/C-M.x,(D.y-3*C)/C-M.y))}};u=new mxKeyHandler(R);u.bindKey(46,E);u.bindKey(8,E);R.getRubberband().isForceRubberbandEvent=function(C){return 0==C.evt.button&&(null==C.getCell()||C.getCell()==J)};R.panningHandler.isForcePanningEvent=function(C){return 2==
C.evt.button};var c=R.isCellSelectable;R.isCellSelectable=function(C){return C==J?!1:c.apply(this,arguments)};R.getLinkForCell=function(){return null};var e=R.view.getState(J);H=R.getAllConnectionConstraints(e);for(var g=0;null!=H&&g<H.length;g++){var q=R.getConnectionPoint(e,H[g]);v(q.x-3,q.y-3,H[g])}R.fit(8);R.center();g=b.createToolbarButton(Editor.zoomInImage,mxResources.get("zoomIn"),function(){R.zoomIn()},20);g.setAttribute("disabled","disabled");q=b.createToolbarButton(Editor.zoomOutImage,