Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!0;this.graph.processElements(this.textarea,function(ea){P||window.getSelection().containsNode(ea,!0)?(ea.removeAttribute("align"),ea.style.textAlign=null):X=!1});X&&this.graph.cellEditor.setAlign(x)}document.execCommand("justify"+x.toLowerCase(),!1,null)};mxCellEditor.prototype.saveSelection=function(){if(window.getSelection){var x=window.getSelection();if(x.getRangeAt&&x.rangeCount){for(var L=[],P=0,X=x.rangeCount;P<X;++P)L.push(x.getRangeAt(P));return L}}else if(document.selection&&document.selection.createRange)return document.selection.createRange();
return null};mxCellEditor.prototype.restoreSelection=function(x){try{if(x)if(window.getSelection){sel=window.getSelection();sel.removeAllRanges();for(var L=0,P=x.length;L<P;++L)sel.addRange(x[L])}else document.selection&&x.select&&x.select()}catch(X){}};var v=mxCellRenderer.prototype.initializeLabel;mxCellRenderer.prototype.initializeLabel=function(x){null!=x.text&&(x.text.replaceLinefeeds="0"!=mxUtils.getValue(x.style,"nl2Br","1"));v.apply(this,arguments)};var z=mxConstraintHandler.prototype.update;