Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"cells",[C])),b.fireEvent(new mxEventObject("freehandInserted","cell",C))}finally{b.model.endUpdate()}q&&b.setSelectionCells([C])}}for(C=0;C<u.length;C++)u[C].parentNode.removeChild(u[C]);d=null;u=[];E=[]}x(!1)};b.addListener(mxEvent.FIRE_MOUSE_EVENT,mxUtils.bind(this,function(z,C){z=C.getProperty("eventName");C=C.getProperty("event");z==mxEvent.MOUSE_MOVE&&e&&(null!=C.sourceState&&C.sourceState.setCursor("crosshair"),C.consume())}));b.addMouseListener({mouseDown:mxUtils.bind(this,function(z,C){if(b.isEnabled()&&
!b.isCellLocked(b.getDefaultParent())&&(z=C.getEvent(),e&&!mxEvent.isPopupTrigger(z)&&!mxEvent.isMultiTouchEvent(z))){var D=parseFloat(b.currentVertexStyle[mxConstants.STYLE_STROKEWIDTH]||1);D=Math.max(1,D*b.view.scale);var M=A();d=document.createElementNS("http://www.w3.org/2000/svg","path");d.setAttribute("fill",t?M:"none");d.setAttribute("stroke",M);d.setAttribute("stroke-width",D);"1"==b.currentVertexStyle[mxConstants.STYLE_DASHED]&&(M=b.currentVertexStyle[mxConstants.STYLE_DASH_PATTERN]||"3 3",
M=M.split(" ").map(function(K){return parseFloat(K)*D}).join(" "),d.setAttribute("stroke-dasharray",M));c=[];z=S(z);l(z);v="M"+z.x+" "+z.y;E.push(z);F=[];d.setAttribute("d",t?PerfectFreehand.getSvgPathFromStroke([[z.x,z.y]],p):v);f.appendChild(d);C.consume()}}),mouseMove:mxUtils.bind(this,function(z,C){if(d&&b.isEnabled()&&!b.isCellLocked(b.getDefaultParent())){z=C.getEvent();z=S(z);l(z);var D=n(0);if(D)if(E.push(D),t){var M=[];for(D=0;D<E.length;D++)M.push([E[D].x,E[D].y]);F=[];for(var K=2;K<c.length;K+=