Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.secondDiv&&(this.secondDiv.parentNode.removeChild(this.secondDiv),this.secondDiv=null);ka.apply(this,arguments)};var qa=(new Date).getTime(),ra=0,pa=mxEdgeHandler.prototype.updatePreviewState;mxEdgeHandler.prototype.updatePreviewState=function(x,L,P,X){pa.apply(this,arguments);P!=this.currentTerminalState?(qa=(new Date).getTime(),ra=0):ra=(new Date).getTime()-qa;this.currentTerminalState=P};var wa=mxEdgeHandler.prototype.isOutlineConnectEvent;mxEdgeHandler.prototype.isOutlineConnectEvent=function(x){return mxEvent.isShiftDown(x.getEvent())&&
mxEvent.isAltDown(x.getEvent())?!1:null!=this.currentTerminalState&&x.getState()==this.currentTerminalState&&2E3<ra||(null==this.currentTerminalState||"0"!=mxUtils.getValue(this.currentTerminalState.style,"outlineConnect","1"))&&wa.apply(this,arguments)};mxEdgeHandler.prototype.createHandleShape=function(x,L,P){L=null!=x&&0==x;var X=this.state.getVisibleTerminalState(L);x=null!=x&&(0==x||x>=this.state.absolutePoints.length-1||this.constructor==mxElbowEdgeHandler&&2==x)?this.graph.getConnectionConstraint(this.state,