Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.getValue(L,mxConstants.STYLE_ELBOW,mxConstants.ELBOW_HORIZONTAL)==mxConstants.ELBOW_HORIZONTAL?mxConstants.ELBOW_VERTICAL:mxConstants.ELBOW_HORIZONTAL;this.setCellStyles(mxConstants.STYLE_ELBOW,L,[x])}};Graph.prototype.isValidRoot=function(x){for(var L=this.model.getChildCount(x),P=0,X=0;X<L;X++){var ea=this.model.getChildAt(x,X);this.model.isVertex(ea)&&(ea=this.getCellGeometry(ea),null==ea||ea.relative||P++)}return 0<P||this.isContainer(x)};Graph.prototype.isValidDropTarget=function(x,L,
P){for(var X=this.getCurrentCellStyle(x),ea=!0,la=!0,oa=0;oa<L.length&&la;oa++)ea=ea&&this.isTable(L[oa]),la=la&&this.isTableRow(L[oa]);return!this.isCellLocked(x)&&(1==L.length&&null!=P&&mxEvent.isShiftDown(P)&&!mxEvent.isControlDown(P)&&!mxEvent.isAltDown(P)||this.isTargetShape(x,L,P)||("1"!=mxUtils.getValue(X,"part","0")||this.isContainer(x))&&"0"!=mxUtils.getValue(X,"dropTarget","1")&&(mxGraph.prototype.isValidDropTarget.apply(this,arguments)||this.isContainer(x))&&!this.isTableRow(x)&&(!this.isTable(x)||
la||ea))};Graph.prototype.createGroupCell=function(){var x=mxGraph.prototype.createGroupCell.apply(this,arguments);x.setStyle("group");return x};Graph.prototype.isExtendParentsOnAdd=function(x){var L=mxGraph.prototype.isExtendParentsOnAdd.apply(this,arguments);if(L&&null!=x&&null!=this.layoutManager){var P=this.model.getParent(x);null!=P&&(P=this.layoutManager.getLayout(P),null!=P&&P.constructor==mxStackLayout&&(L=!1))}return L};Graph.prototype.getPreferredSizeForCell=function(x){var L=mxGraph.prototype.getPreferredSizeForCell.apply(this,