Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
I.vertex=!0;M.addCell(I);M.dblClick=function(J,G){if(null!=G&&G!=I)M.setSelectionCell(G);else{G=mxUtils.convertPoint(M.container,mxEvent.getClientX(J),mxEvent.getClientY(J));mxEvent.consume(J);J=M.view.scale;var P=M.view.translate;M.setSelectionCell(l((G.x-3*J)/J-P.x,(G.y-3*J)/J-P.y))}};k=new mxKeyHandler(M);k.bindKey(46,x);k.bindKey(8,x);M.getRubberband().isForceRubberbandEvent=function(J){return 0==J.evt.button&&(null==J.getCell()||J.getCell()==I)};M.panningHandler.isForcePanningEvent=function(J){return 2==
J.evt.button};var d=M.isCellSelectable;M.isCellSelectable=function(J){return J==I?!1:d.apply(this,arguments)};M.getLinkForCell=function(){return null};var g=M.view.getState(I);z=M.getAllConnectionConstraints(g);for(var n=0;null!=z&&n<z.length;n++){var t=M.getConnectionPoint(g,z[n]);l(t.x-3,t.y-3,z[n])}M.fit(8);M.center();n=b.createToolbarButton(Editor.zoomInImage,mxResources.get("zoomIn"),function(){M.zoomIn()},20);n.setAttribute("disabled","disabled");t=b.createToolbarButton(Editor.zoomOutImage,