Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxCellEditor.prototype.installListeners=function(x){function L(ea,la){la.originalNode=ea;ea=ea.firstChild;for(var oa=la.firstChild;null!=ea&&null!=oa;)L(ea,oa),ea=ea.nextSibling,oa=oa.nextSibling;return la}function P(ea,la){if(null!=ea)if(la.originalNode!=ea)X(ea);else for(ea=ea.firstChild,la=la.firstChild;null!=ea;){var oa=ea.nextSibling;null==la?X(ea):(P(ea,la),la=la.nextSibling);ea=oa}}function X(ea){for(var la=ea.firstChild;null!=la;){var oa=la.nextSibling;X(la);la=oa}1==ea.nodeType&&("BR"===
ea.nodeName||null!=ea.firstChild)||3==ea.nodeType&&0!=mxUtils.trim(mxUtils.getTextContent(ea)).length?(3==ea.nodeType&&mxUtils.setTextContent(ea,mxUtils.getTextContent(ea).replace(/\n|\r/g,"")),1==ea.nodeType&&(ea.removeAttribute("style"),ea.removeAttribute("class"),ea.removeAttribute("width"),ea.removeAttribute("cellpadding"),ea.removeAttribute("cellspacing"),ea.removeAttribute("border"))):ea.parentNode.removeChild(ea)}H.apply(this,arguments);7!==document.documentMode&&8!==document.documentMode&&
mxEvent.addListener(this.textarea,"paste",mxUtils.bind(this,function(ea){var la=L(this.textarea,this.textarea.cloneNode(!0));window.setTimeout(mxUtils.bind(this,function(){null!=this.textarea&&(0<=this.textarea.innerHTML.indexOf("<o:OfficeDocumentSettings>")||0<=this.textarea.innerHTML.indexOf("\x3c!--[if !mso]>")?P(this.textarea,la):Graph.removePasteFormatting(this.textarea))}),0)}))};mxCellEditor.prototype.toggleViewMode=function(){var x=this.graph.view.getState(this.editingCell);if(null!=x){var L=