Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
40==aa.keyCode&&(V(la,mxConstants.DIRECTION_SOUTH),mxEvent.consume(aa)))}}catch(P){d.handleError(P)}mxEvent.isConsumed(aa)||H.apply(this,arguments)};var ja=f.connectVertex;f.connectVertex=function(aa,la,X,P,U,k,z){var J=f.getIncomingTreeEdges(aa);if(n(aa)){var W=K(aa),T=W==mxConstants.DIRECTION_EAST||W==mxConstants.DIRECTION_WEST,Z=la==mxConstants.DIRECTION_EAST||la==mxConstants.DIRECTION_WEST;return W==la||0==J.length?L(aa,la):T==Z?G(aa):S(aa,la!=mxConstants.DIRECTION_NORTH&&la!=mxConstants.DIRECTION_WEST)}return ja.apply(this,
arguments)};f.getSubtree=function(aa){var la=[aa];!y(aa)&&!n(aa)||E(aa)||f.traverse(aa,!0,function(X,P){var U=null!=P&&f.isTreeEdge(P);U&&0>mxUtils.indexOf(la,P)&&la.push(P);(null==P||U)&&0>mxUtils.indexOf(la,X)&&la.push(X);return null==P||U});return la};var da=mxVertexHandler.prototype.init;mxVertexHandler.prototype.init=function(){da.apply(this,arguments);(y(this.state.cell)||n(this.state.cell))&&!E(this.state.cell)&&0<this.graph.getOutgoingTreeEdges(this.state.cell).length&&(this.moveHandle=mxUtils.createImage(Editor.moveImage),