Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.bind(this,function(R,W,d,f){var k=this.actions.get(d);null!=k&&(d=function(){k.isEnabled()&&k.funct.apply(this,arguments)},W?f?y.bindControlShiftKey(R,d):y.bindControlKey(R,d):f?y.bindShiftKey(R,d):y.bindKey(R,d))});var F=this,K=y.escape;y.escape=function(R){K.apply(this,arguments)};y.enter=function(){};y.bindControlShiftKey(36,function(){n.exitGroup()});y.bindControlShiftKey(35,function(){n.enterGroup()});y.bindShiftKey(36,function(){n.home()});y.bindKey(35,function(){n.refresh()});y.bindAction(107,