Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
y.getModel().addListener(mxEvent.CHANGE,this.selectionStateListener);y.addListener(mxEvent.EDITING_STARTED,this.selectionStateListener);y.addListener(mxEvent.EDITING_STOPPED,this.selectionStateListener);y.getView().addListener("unitChanged",this.selectionStateListener);this.editor.chromeless&&!this.editor.editable&&(this.footerHeight=0,y.isEnabled=function(){return!1},y.panningHandler.isForcePanningEvent=function(Q){return!mxEvent.isPopupTrigger(Q.getEvent())});this.actions=new Actions(this);this.menus=