Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var H=y.cellEditor.isStopEditingEvent;y.cellEditor.isStopEditingEvent=function(Q){return H.apply(this,arguments)||13==Q.keyCode&&(!mxClient.IS_SF&&mxEvent.isControlDown(Q)||mxClient.IS_MAC&&mxEvent.isMetaDown(Q)||mxClient.IS_SF&&mxEvent.isShiftDown(Q))};var J=y.isZoomWheelEvent;y.isZoomWheelEvent=function(){return n.isSpaceDown()||J.apply(this,arguments)};var O=!1,G=null,ja=null,fa=null,ca=mxUtils.bind(this,function(){if(null!=this.toolbar&&O!=y.cellEditor.isContentEditing()){for(var Q=this.toolbar.container.firstChild,