Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph=function(b,e,g,n,y,q){mxGraph.call(this,b,e,g,n);this.themes=y||this.defaultThemes;this.currentEdgeStyle=mxUtils.clone(this.defaultEdgeStyle);this.currentVertexStyle=mxUtils.clone(this.defaultVertexStyle);this.standalone=null!=q?q:!1;b=this.baseUrl;e=b.indexOf("//");this.domainPathUrl=this.domainUrl="";0<e&&(e=b.indexOf("/",e+2),0<e&&(this.domainUrl=b.substring(0,e)),e=b.lastIndexOf("/"),0<e&&(this.domainPathUrl=b.substring(0,e+1)));this.isHtmlLabel=function(X){X=this.getCurrentCellStyle(X);
return null!=X?"1"==X.html||"wrap"==X[mxConstants.STYLE_WHITE_SPACE]:!1};if(this.immediateHandling){var E=null,K=null,S=null,G=null,L=!1,R=!1;this.addListener(mxEvent.FIRE_MOUSE_EVENT,mxUtils.bind(this,function(X,P){if("mouseDown"==P.getProperty("eventName")&&this.isEnabled()){X=P.getProperty("event");var U=X.getState();P=this.view.scale;if(!mxEvent.isAltDown(X.getEvent())&&null!=U&&(R=this.isCellSelected(U.cell),!this.panningHandler.isActive()&&!mxEvent.isControlDown(X.getEvent()))){var k=this.selectionCellsHandler.getHandler(U.cell);