Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxConstraintHandler.prototype.update=function(x,L){this.isKeepFocusEvent(x)||!mxEvent.isAltDown(x.getEvent())?z.apply(this,arguments):this.reset()};mxGuide.prototype.createGuideShape=function(x){return new mxPolyline([],mxConstants.GUIDE_COLOR,mxConstants.GUIDE_STROKEWIDTH)};mxCellEditor.prototype.escapeCancelsEditing=!1;var A=mxCellEditor.prototype.startEditing;mxCellEditor.prototype.startEditing=function(x,L){x=this.graph.getStartEditingCell(x,L);A.apply(this,arguments);var P=this.graph.view.getState(x);
this.textarea.className=null!=P&&1==P.style.html?"mxCellEditor geContentEditable":"mxCellEditor mxPlainTextEditor";this.codeViewMode=!1;this.switchSelectionState=null;this.graph.setSelectionCell(x);P=this.graph.getModel().getParent(x);var X=this.graph.getCellGeometry(x);if(this.graph.getModel().isEdge(P)&&null!=X&&X.relative||this.graph.getModel().isEdge(x))this.textarea.style.outline=mxClient.IS_IE||mxClient.IS_IE11||mxClient.IS_FF&&mxClient.IS_WIN?"gray dotted 1px":""};var H=mxCellEditor.prototype.installListeners;