Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ArrangePanel.prototype.addGroupOps=function(a){var b=this.editorUi.getSelectionState();a.style.paddingTop="8px";a.style.paddingBottom="6px";var e=0;b.cell||b.row||(e+=this.addActions(a,["group","ungroup","copySize","pasteSize","swap"])+this.addActions(a,["removeFromGroup"]));b=this.addAction(a,"clearWaypoints");null!=b&&(mxUtils.br(a),b.setAttribute("title",mxResources.get("clearWaypoints")+" ("+this.editorUi.actions.get("clearWaypoints").shortcut+") Shift+Click to Clear Anchor Points"),e++);e+=this.addActions(a,
["lockUnlock"]);0==e&&(a.style.display="none");return a};