Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Y.y||0<Y.height)&&mxUtils.intersects(S,new mxRectangle(U.x,U.y+(Y.y-Y.height-1)*C+(0==Y.y?U.height:0),U.width,1))&&(m="row-resize")),U=this.view.getState(this.model.getParent(U.cell))}null!=m&&Q.setCursor(m)}}}),mouseUp:mxUtils.bind(this,function(S,U){F=E=N=T=null})})}this.cellRenderer.minSvgStrokeWidth=.1;this.cellRenderer.getLabelValue=function(S){var U=mxCellRenderer.prototype.getLabelValue.apply(this,arguments);S.view.graph.isHtmlLabel(S.cell)&&(1!=S.style.html?U=mxUtils.htmlEntities(U,!1):S.lastLabelValue!=
U&&(S.lastLabelValue=U,U=Graph.sanitizeHtml(U)));return U};if("undefined"!==typeof mxVertexHandler){this.setConnectable(!0);this.setDropEnabled(!0);this.setPanning(!0);this.setTooltips(!0);this.setAllowLoops(!0);this.allowAutoPanning=!0;this.constrainChildren=this.resetEdgesOnConnect=!1;this.constrainRelativeChildren=!0;this.graphHandler.scrollOnMove=!1;this.graphHandler.scaleGrid=!0;this.connectionHandler.setCreateTarget(!1);this.connectionHandler.insertBeforeSource=!0;this.connectionHandler.isValidSource=