Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
0,z.x,z.y));null!=z&&v.appendChild(this.sidebar.createVertexTemplateFromCells([k],z.width,z.height,"",!0,!1,null,!1,mxUtils.bind(this,function(A){if(!mxEvent.isShiftDown(A)||null==g&&R.isSelectionEmpty()){var H=R.cloneCell(k);if(null!=n)n(H);else{var J=T([H]);R.model.isEdge(H)?H.geometry.translate(J.x,J.y):(H.geometry.x=J.x,H.geometry.y=J.y);R.model.beginUpdate();try{R.addCell(H),R.model.isVertex(H)&&R.isAutoSizeCell(H)&&R.updateCellSize(H)}finally{R.model.endUpdate()}R.setSelectionCell(H);R.scrollCellToVisible(H);
K&&R.startEditing(H);null!=d.hoverIcons&&d.hoverIcons.update(R.view.getState(H))}}else H=R.getEditableCells(null!=g?[g]:R.getSelectionCells()),R.updateShapes(k,H);null!=q&&q(A);mxEvent.consume(A)}),25,25,null,null,g))});for(F=0;F<(N?Math.min(E.length,4):E.length);F++)y(E[F]);E=W.offsetTop+W.clientHeight-(R.container.scrollTop+R.container.offsetHeight);0<E&&(W.style.top=Math.max(R.container.scrollTop+22,e-E)+"px");E=W.offsetLeft+W.clientWidth-(R.container.scrollLeft+R.container.offsetWidth);0<E&&(W.style.left=