Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"cells",[C])),b.fireEvent(new mxEventObject("freehandInserted","cell",C))}finally{b.model.endUpdate()}q&&b.setSelectionCells([C])}}for(C=0;C<u.length;C++)u[C].parentNode.removeChild(u[C]);d=null;u=[];E=[]}x(!1)};b.addListener(mxEvent.FIRE_MOUSE_EVENT,mxUtils.bind(this,function(z,C){z=C.getProperty("eventName");C=C.getProperty("event");z==mxEvent.MOUSE_MOVE&&e&&(null!=C.sourceState&&C.sourceState.setCursor("crosshair"),C.consume())}));b.addMouseListener({mouseDown:mxUtils.bind(this,function(z,C){if(b.isEnabled()&&