Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
X.getRangeAt&&X.rangeCount&&(P=L(X.getRangeAt(0)))}X=[];for(var ea=0;ea<P.length;ea++)for(var la=P[ea];null!=this.cellEditor.textarea&&this.cellEditor.textarea.contains(la)&&la!=this.cellEditor.textarea&&null!=la.parentNode;)if(la.nodeType==mxConstants.NODETYPE_ELEMENT&&"block"==mxUtils.getCurrentStyle(la).display){0>mxUtils.indexOf(X,la)&&X.push(la);break}else la=la.parentNode;return X};Graph.prototype.getSelectedElement=function(){var x=null;if(window.getSelection){var L=window.getSelection();L.getRangeAt&&
L.rangeCount&&(x=L.getRangeAt(0).commonAncestorContainer)}else document.selection&&(x=document.selection.createRange().parentElement());return x};Graph.prototype.getSelectedEditingElement=function(){for(var x=this.getSelectedElement();null!=x&&x.nodeType!=mxConstants.NODETYPE_ELEMENT;)x=x.parentNode;null!=x&&x==this.cellEditor.textarea&&1==this.cellEditor.textarea.children.length&&this.cellEditor.textarea.firstChild.nodeType==mxConstants.NODETYPE_ELEMENT&&(x=this.cellEditor.textarea.firstChild);return x};