Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxVertexHandler.prototype.getSelectionBounds=function(x){var L=this.graph.getModel(),P=L.getParent(x.cell),X=this.graph.getCellGeometry(x.cell);return L.isEdge(P)&&null!=X&&X.relative&&2>x.width&&2>x.height&&null!=x.text&&null!=x.text.boundingBox?(L=x.text.unrotatedBoundingBox||x.text.boundingBox,new mxRectangle(Math.round(L.x),Math.round(L.y),Math.round(L.width),Math.round(L.height))):Oa.apply(this,arguments)};var Qa=mxVertexHandler.prototype.mouseDown;mxVertexHandler.prototype.mouseDown=function(x,
L){var P=this.graph.getModel(),X=P.getParent(this.state.cell),ea=this.graph.getCellGeometry(this.state.cell);(this.getHandleForEvent(L)==mxEvent.ROTATION_HANDLE||!P.isEdge(X)||null==ea||!ea.relative||null==this.state||2<=this.state.width||2<=this.state.height)&&Qa.apply(this,arguments)};mxVertexHandler.prototype.rotateClick=function(){var x=mxUtils.getValue(this.state.style,mxConstants.STYLE_STROKECOLOR,mxConstants.NONE),L=mxUtils.getValue(this.state.style,mxConstants.STYLE_FILLCOLOR,mxConstants.NONE);