Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
P&&(G=this.getDeletableCells(this.addAllEdges(G)));for(var O=[],N=0;N<G.length;N++){var T=G[N];n.isEdge(T)&&l(T)&&(O.push(T),T=n.getTerminal(T,!1));if(c(T)){var m=[];g.traverse(T,!0,function(B,K){var R=null!=K&&g.isTreeEdge(K);R&&m.push(K);(null==K||R)&&m.push(B);return null==K||R});0<m.length&&(O=O.concat(m),T=g.getIncomingTreeEdges(G[N]),G=G.concat(T))}else null!=T&&O.push(G[N])}G=O;return u.apply(this,arguments)};d.hoverIcons.getStateAt=function(G,P,O){return c(G.cell)?null:this.graph.view.getState(this.graph.getCellAt(P,
O))};var v=g.duplicateCells;g.duplicateCells=function(G,P){G=null!=G?G:this.getSelectionCells();for(var O=G.slice(0),N=0;N<O.length;N++){var T=g.view.getState(O[N]);if(null!=T&&c(T.cell)){var m=g.getIncomingTreeEdges(T.cell);for(T=0;T<m.length;T++)mxUtils.remove(m[T],G)}}this.model.beginUpdate();try{var B=v.call(this,G,P);if(B.length==G.length)for(N=0;N<G.length;N++)if(c(G[N])){var K=g.getIncomingTreeEdges(B[N]);m=g.getIncomingTreeEdges(G[N]);if(0==K.length&&0<m.length){var R=this.cloneCell(m[0]);