Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
oa.tooltipHandler.reset(va,!0,this.currentState),(null==this.currentState||va.getState()!=this.currentState&&null!=va.sourceState||!oa.intersects(this.currentState,va.getGraphX(),va.getGraphY()))&&this.updateCurrentState(va))}},mouseUp:function(sa,va){var Fa=va.getSource();for(sa=va.getEvent();null!=Fa&&"a"!=Fa.nodeName.toLowerCase();)Fa=Fa.parentNode;null==Fa&&Math.abs(this.scrollLeft-oa.container.scrollLeft)<la&&Math.abs(this.scrollTop-oa.container.scrollTop)<la&&(null==va.sourceState||!va.isSource(va.sourceState.control))&&
((mxEvent.isLeftMouseButton(sa)||mxEvent.isMiddleMouseButton(sa))&&!mxEvent.isPopupTrigger(sa)||mxEvent.isTouchEvent(sa))&&(null!=this.currentLink?(Fa=oa.isBlankLink(this.currentLink),"data:"!==this.currentLink.substring(0,5)&&Fa||null==L||L(sa,this.currentLink),mxEvent.isConsumed(sa)||(sa=null!=this.currentTarget?this.currentTarget:mxEvent.isMiddleMouseButton(sa)?"_blank":Fa?oa.linkTarget:"_top",oa.openLink(this.currentLink,sa),va.consume())):null!=P&&!va.isConsumed()&&Math.abs(this.scrollLeft-oa.container.scrollLeft)<
la&&Math.abs(this.scrollTop-oa.container.scrollTop)<la&&Math.abs(this.startX-va.getGraphX())<la&&Math.abs(this.startY-va.getGraphY())<la&&P(va.getEvent()));this.clear()},activate:function(sa){this.currentLink=oa.getAbsoluteUrl(oa.getLinkForCell(sa.cell));null!=this.currentLink&&(this.currentTarget=oa.getLinkTargetForCell(sa.cell),oa.container.style.cursor="pointer",null!=this.highlight&&this.highlight.highlight(sa))},clear:function(){null!=oa.container&&(oa.container.style.cursor=ea);this.currentLink=