Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!0),ea.push(xa))}for(var L=fa.apply(this,arguments),P=new mxDictionary,X=this.graph.model,ea=[],la=0;la<L.length;la++){var oa=L[la];this.graph.isTableCell(oa)?x(X.getParent(X.getParent(oa))):this.graph.isTableRow(oa)&&x(X.getParent(oa));x(oa)}return ea};var ca=mxVertexHandler.prototype.isGhostPreview;mxVertexHandler.prototype.isGhostPreview=function(){return ca.apply(this,arguments)&&!this.graph.isTable(this.state.cell)&&!this.graph.isTableRow(this.state.cell)&&!this.graph.isTableCell(this.state.cell)&&
!this.graph.isSwimlane(this.state.cell)};var ia=mxVertexHandler.prototype.createParentHighlightShape;mxVertexHandler.prototype.createParentHighlightShape=function(x){var L=ia.apply(this,arguments);L.stroke="#C0C0C0";L.strokewidth=1;return L};var ma=mxEdgeHandler.prototype.createParentHighlightShape;mxEdgeHandler.prototype.createParentHighlightShape=function(x){var L=ma.apply(this,arguments);L.stroke="#C0C0C0";L.strokewidth=1;return L};mxVertexHandler.prototype.rotationHandleVSpacing=-12;mxVertexHandler.prototype.getRotationHandlePosition=