Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxEvent.getClientX(K),mxEvent.getClientY(K)),G.start(K.x,K.y)):null!=qa?this.addSelectionCells(qa):1<this.getSelectionCount()&&this.isCellSelected(L)&&this.removeSelectionCell(L);qa=null;U.consume()}}));this.connectionHandler.selectCells=function(K,U){this.graph.setSelectionCell(U||K)};this.connectionHandler.constraintHandler.isStateIgnored=function(K,U){var L=K.view.graph;return U&&(L.isCellSelected(K.cell)||L.isTableRow(K.cell)&&L.selectionCellsHandler.isHandled(L.model.getParent(K.cell)))};this.selectionModel.addListener(mxEvent.CHANGE,