Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
M?(M=e.getOutgoingTreeEdges(D),null!=M&&0<M.length&&e.setSelectionCell(e.model.getTerminal(M[0],!1))):(K=e.getIncomingTreeEdges(D),null!=K&&0<K.length&&(O=R(e.model.getTerminal(K[0],!0),O,D),D=e.view.getState(D),null!=D&&(D=mxUtils.indexOf(O,D),0<=D&&(D+=M==mxConstants.DIRECTION_NORTH||M==mxConstants.DIRECTION_WEST?-1:1,0<=D&&D<=O.length-1&&e.setSelectionCell(O[D].cell)))))}var c=this,e=c.editor.graph,g=e.getModel(),q=c.menus.createPopupMenu;c.menus.createPopupMenu=function(D,M,K){q.apply(this,arguments);
if(1==e.getSelectionCount()){M=e.getSelectionCell();var O=e.getOutgoingTreeEdges(M);D.addSeparator();0<O.length&&(d(e.getSelectionCell())&&this.addMenuItems(D,["selectChildren"],null,K),this.addMenuItems(D,["selectDescendants"],null,K));d(e.getSelectionCell())?(D.addSeparator(),0<e.getIncomingTreeEdges(M).length&&this.addMenuItems(D,["selectSiblings","selectParent"],null,K)):0<e.model.getEdgeCount(M)&&this.addMenuItems(D,["selectConnections"],null,K)}};c.actions.addAction("selectChildren",function(D){if(e.isEnabled()&&