Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"checked"):(J=parseInt(M[5]),x.value=J,q.setAttribute("checked","checked"),t.style.visibility="visible"):g.setAttribute("checked","checked")):m=null}else m=null}catch(Q){}c.style=e+(m?m:u());c.vertex=!0;H.addCell(c,null,null,null,null);H.selectAll();H.addListener(mxEvent.CELLS_MOVED,A);H.addListener(mxEvent.CELLS_RESIZED,A);var y=H.graphHandler.mouseUp,G=H.graphHandler.mouseDown;H.graphHandler.mouseUp=function(){y.apply(this,arguments);N.style.backgroundColor="#fff9"};H.graphHandler.mouseDown=function(){G.apply(this,
arguments);N.style.backgroundColor=""};H.dblClick=function(){};var P=H.getSelectionModel().changeSelection;H.getSelectionModel().changeSelection=function(){P.call(this,[c],[c])}};L.onerror=function(){L.onload=null;L.src=Editor.errorImage};L.setAttribute("src",f);L.style.maxWidth="300px";L.style.maxHeight="300px";F.appendChild(L);E.appendChild(F);var N=document.createElement("div");N.style.width="300px";N.style.height="300px";N.style.overflow="hidden";N.style.backgroundColor="#fff9";E.appendChild(N);