Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
0,A.x,A.y));null!=A&&u.appendChild(this.sidebar.createVertexTemplateFromCells([l],A.width,A.height,"",!0,!1,null,!1,mxUtils.bind(this,function(B){if(!mxEvent.isShiftDown(B)||null==g&&R.isSelectionEmpty()){var F=R.cloneCell(l);if(null!=n)n(F);else{var M=S([F]);R.model.isEdge(F)?F.geometry.translate(M.x,M.y):(F.geometry.x=M.x,F.geometry.y=M.y);R.model.beginUpdate();try{R.addCell(F),R.model.isVertex(F)&&R.isAutoSizeCell(F)&&R.updateCellSize(F)}finally{R.model.endUpdate()}R.setSelectionCell(F);R.scrollCellToVisible(F);
L&&R.startEditing(F);null!=d.hoverIcons&&d.hoverIcons.update(R.view.getState(F))}}else F=R.getEditableCells(null!=g?[g]:R.getSelectionCells()),R.updateShapes(l,F);null!=q&&q(B);mxEvent.consume(B)}),25,25,null,null,g))});for(G=0;G<(K?Math.min(E.length,4):E.length);G++)y(E[G]);E=V.offsetTop+V.clientHeight-(R.container.scrollTop+R.container.offsetHeight);0<E&&(V.style.top=Math.max(R.container.scrollTop+22,e-E)+"px");E=V.offsetLeft+V.clientWidth-(R.container.scrollLeft+R.container.offsetWidth);0<E&&(V.style.left=