Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
g);var q=this.hoverIcons.drag;this.hoverIcons.drag=function(){e.hideShapePicker();q.apply(this,arguments)};var E=this.hoverIcons.execute;this.hoverIcons.execute=function(T,F,K){var R=K.getEvent();this.graph.isCloneEvent(R)||mxEvent.isShiftDown(R)?E.apply(this,arguments):this.graph.connectVertex(T.cell,F,this.graph.defaultEdgeLength,R,null,null,mxUtils.bind(this,function(W,d,f){var k=b.getCompositeParent(T.cell);W=b.getCellGeometry(k);for(K.consume();null!=k&&b.model.isVertex(k)&&null!=W&&W.relative;)cell=
k,k=b.model.getParent(cell),W=b.getCellGeometry(k);window.setTimeout(mxUtils.bind(this,function(){e.showShapePicker(K.getGraphX(),K.getGraphY(),k,mxUtils.bind(this,function(v){f(v);null!=e.hoverIcons&&e.hoverIcons.update(b.view.getState(v))}),F)}),30)}),mxUtils.bind(this,function(W){this.graph.selectCellsForConnectVertex(W,R,this)}))};var N=null;this.hoverIcons.addListener("focus",mxUtils.bind(this,function(T,F){null!=N&&window.clearTimeout(N);N=window.setTimeout(mxUtils.bind(this,function(){var K=