Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(mxUtils.contains(X.text.boundingBox,P.x,P.y)||mxUtils.isAncestorNode(X.text.node,mxEvent.getSource(x)))||(null!=X||this.isCellLocked(this.getDefaultParent()))&&(null==X||this.isCellLocked(X.cell))||!(null!=X||mxClient.IS_SVG&&ea==this.view.getCanvas().ownerSVGElement)||(null==X&&(X=this.view.getState(this.getCellAt(P.x,P.y))),L=this.addText(P.x,P.y,X))}return L};Graph.prototype.getInsertPoint=function(){var x=this.getGridSize(),L=this.container.scrollLeft/this.view.scale-this.view.translate.x,P=
this.container.scrollTop/this.view.scale-this.view.translate.y;if(this.pageVisible){var X=this.getPageLayout(),ea=this.getPageSize();L=Math.max(L,X.x*ea.width);P=Math.max(P,X.y*ea.height)}return new mxPoint(this.snap(L+x),this.snap(P+x))};Graph.prototype.getFreeInsertPoint=function(){var x=this.view,L=this.getGraphBounds(),P=this.getInsertPoint(),X=this.snap(Math.round(Math.max(P.x,L.x/x.scale-x.translate.x+(0==L.width?2*this.gridSize:0))));x=this.snap(Math.round(Math.max(P.y,(L.y+L.height)/x.scale-