Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.updateSelectionStateForTableCells=function(b){if(1<b.cells.length&&b.cell){var e=mxUtils.sortCells(b.cells),g=this.editor.graph.model,n=g.getParent(e[0]),y=g.getParent(n);if(null!=n&&null!=y){for(var q=n.getIndex(e[0]),E=y.getIndex(n),N=null,T=1,F=1,K=0,R=E<y.getChildCount()-1?g.getChildAt(g.getChildAt(y,E+1),q):null;K<e.length-1;){var W=e[++K];null==R||R!=W||null!=N&&T!=N||(N=T,T=0,F++,n=g.getParent(R),R=E+F<y.getChildCount()?g.getChildAt(g.getChildAt(y,E+F),q):null);var d=this.editor.graph.view.getState(W);
if(W==g.getChildAt(n,q+T)&&null!=d&&1==mxUtils.getValue(d.style,"colspan",1)&&1==mxUtils.getValue(d.style,"rowspan",1))T++;else break}K==F*T-1&&(b.mergeCell=e[0],b.colspan=T,b.rowspan=F)}}};EditorUi.prototype.windowResized=function(){window.setTimeout(mxUtils.bind(this,function(){null!=this.editor.graph&&this.refresh()}),0)};