Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.moveHandles[x]&&this.moveHandles[x].parentNode.removeChild(this.moveHandles[x]);this.moveHandles=null}};mxVertexHandler.prototype.createMoveHandles=function(){for(var x=this.graph,L=x.model,P=[],X=0;X<L.getChildCount(this.state.cell);X++)mxUtils.bind(this,function(ea){if(null!=ea&&L.isVertex(ea.cell)&&x.isCellMovable(ea.cell)){var la=new mxRectangle(0,0,this.rowHandleImage.width,this.rowHandleImage.height);la=new mxImageShape(la,this.rowHandleImage.src);la.rowState=ea;la.dialect=this.graph.dialect!=
mxConstants.DIALECT_SVG?mxConstants.DIALECT_MIXEDHTML:mxConstants.DIALECT_SVG;la.init(this.graph.getView().getOverlayPane());la.node.style.cursor="move";mxEvent.addGestureListeners(la.node,mxUtils.bind(this,function(oa){this.graph.popupMenuHandler.hideMenu();this.graph.stopEditing(!1);!this.graph.isToggleEvent(oa)&&this.graph.isCellSelected(ea.cell)||this.graph.selectCellForEvent(ea.cell,oa);mxEvent.isPopupTrigger(oa)||(this.graph.graphHandler.start(this.state.cell,mxEvent.getClientX(oa),mxEvent.getClientY(oa),
this.graph.getSelectionCells()),this.graph.graphHandler.cellWasClicked=!0,this.graph.isMouseTrigger=mxEvent.isMouseEvent(oa),this.graph.isMouseDown=!0);mxEvent.consume(oa)}),null,mxUtils.bind(this,function(oa){mxEvent.isPopupTrigger(oa)&&(this.graph.popupMenuHandler.popup(mxEvent.getClientX(oa),mxEvent.getClientY(oa),ea.cell,oa),mxEvent.consume(oa))}));P.push(la)}else P.push(null)})(this.graph.view.getState(L.getChildAt(this.state.cell,X)));return P};mxVertexHandler.prototype.destroyMoveHandles=function(){if(null!=