Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
try{n.pasteXml(L,!0)}finally{q.getModel().endUpdate()}}else mxClipboard.paste(q)}),G=!0)}catch(L){}G||mxClipboard.paste(q)}},!1,"sprite-paste",Editor.ctrlKey+"+V");this.addAction("pasteHere",function(G){function L(V){if(null!=V){for(var d=!0,f=0;f<V.length&&d;f++)d=d&&q.model.isEdge(V[f]);var l=q.view.translate;f=q.view.scale;var u=l.x,A=l.y;l=null;if(1==V.length&&d){var B=q.getCellGeometry(V[0]);null!=B&&(l=B.getTerminalPoint(!0))}l=null!=l?l:q.getBoundingBoxFromGeometry(V,d);null!=l&&(d=Math.round(q.snap(q.popupMenuHandler.triggerX/
f-u)),f=Math.round(q.snap(q.popupMenuHandler.triggerY/f-A)),q.cellsMoved(V,d-l.x,f-l.y))}}function R(){q.getModel().beginUpdate();try{L(mxClipboard.paste(q))}finally{q.getModel().endUpdate()}}if(q.isEnabled()&&!q.isCellLocked(q.getDefaultParent())){G=!1;try{Editor.enableNativeCipboard&&(n.readGraphModelFromClipboard(function(V){if(null!=V){q.getModel().beginUpdate();try{L(n.pasteXml(V,!0))}finally{q.getModel().endUpdate()}}else R()}),G=!0)}catch(V){}G||R()}});this.addAction("swap",function(){var G=