Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"userSelect","none"),mxUtils.setPrefixedStyle(this.diagramContainer.style,"userSelect","none"),mxUtils.setPrefixedStyle(this.sidebarContainer.style,"userSelect","none"),mxUtils.setPrefixedStyle(this.formatContainer.style,"userSelect","none"),mxUtils.setPrefixedStyle(this.footerContainer.style,"userSelect","none"),null!=this.tabContainer&&mxUtils.setPrefixedStyle(this.tabContainer.style,"userSelect","none"))));!this.editor.chromeless||this.editor.editable?(e=function(Q){if(null!=Q){var Y=mxEvent.getSource(Q);
if("A"==Y.nodeName)for(;null!=Y;){if("geHint"==Y.className)return!0;Y=Y.parentNode}}return k(Q)},mxClient.IS_IE&&("undefined"===typeof document.documentMode||9>document.documentMode)?mxEvent.addListener(this.diagramContainer,"contextmenu",e):this.diagramContainer.oncontextmenu=e):y.panningHandler.usePopupTrigger=!1;y.init(this.diagramContainer);mxClient.IS_SVG&&null!=y.view.getDrawPane()&&(e=y.view.getDrawPane().ownerSVGElement,null!=e&&(e.style.position="absolute"));this.hoverIcons=this.createHoverIcons();