Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
0;V<D.length;V++){var k=e.view.getState(e.model.getTerminal(D[V],!1));null!=k&&(!M&&Math.min(k.x+k.width,K.x+K.width)>=Math.max(k.x,K.x)||M&&Math.min(k.y+k.height,K.y+K.height)>=Math.max(k.y,K.y))&&O.push(k)}O.sort(function(y,G){return M?y.x+y.width-G.x-G.width:y.y+y.height-G.y-G.height})}return O}function J(D,M){var K=F(D),O=M==mxConstants.DIRECTION_EAST||M==mxConstants.DIRECTION_WEST;(K==mxConstants.DIRECTION_EAST||K==mxConstants.DIRECTION_WEST)==O&&K!=M?c.actions.get("selectParent").funct():K==
M?(M=e.getOutgoingTreeEdges(D),null!=M&&0<M.length&&e.setSelectionCell(e.model.getTerminal(M[0],!1))):(K=e.getIncomingTreeEdges(D),null!=K&&0<K.length&&(O=R(e.model.getTerminal(K[0],!0),O,D),D=e.view.getState(D),null!=D&&(D=mxUtils.indexOf(O,D),0<=D&&(D+=M==mxConstants.DIRECTION_NORTH||M==mxConstants.DIRECTION_WEST?-1:1,0<=D&&D<=O.length-1&&e.setSelectionCell(O[D].cell)))))}var c=this,e=c.editor.graph,g=e.getModel(),q=c.menus.createPopupMenu;c.menus.createPopupMenu=function(D,M,K){q.apply(this,arguments);