Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
161==d.charCodeAt(4)&&177==d.charCodeAt(5)&&26==d.charCodeAt(6)&&225==d.charCodeAt(7)||60==d.charCodeAt(0)&&63==d.charCodeAt(1)&&120==d.charCodeAt(2)&&109==d.charCodeAt(3)&&108==d.charCodeAt(3))};var b=EditorUi.prototype.createKeyHandler;EditorUi.prototype.createKeyHandler=function(d){var g=b.apply(this,arguments);if(!this.editor.chromeless||this.editor.editable){var n=g.getFunction,t=this.editor.graph,u=this;g.getFunction=function(v){if(t.isSelectionEmpty()&&null!=u.pages&&0<u.pages.length){var A=
u.getSelectedPageIndex();if(mxEvent.isShiftDown(v)){if(37==v.keyCode)return function(){0<A&&u.movePage(A,A-1)};if(38==v.keyCode)return function(){0<A&&u.movePage(A,0)};if(39==v.keyCode)return function(){A<u.pages.length-1&&u.movePage(A,A+1)};if(40==v.keyCode)return function(){A<u.pages.length-1&&u.movePage(A,u.pages.length-1)}}else if(mxEvent.isControlDown(v)||mxClient.IS_MAC&&mxEvent.isMetaDown(v)){if(37==v.keyCode)return function(){0<A&&u.selectNextPage(!1)};if(38==v.keyCode)return function(){0<
A&&u.selectPage(u.pages[0])};if(39==v.keyCode)return function(){A<u.pages.length-1&&u.selectNextPage(!0)};if(40==v.keyCode)return function(){A<u.pages.length-1&&u.selectPage(u.pages[u.pages.length-1])}}}return!(65<=v.keyCode&&90>=v.keyCode)||t.isSelectionEmpty()||mxEvent.isAltDown(v)||mxEvent.isShiftDown(v)||mxEvent.isControlDown(v)||mxClient.IS_MAC&&mxEvent.isMetaDown(v)?n.apply(this,arguments):null}}return g};var e=EditorUi.prototype.extractGraphModelFromHtml;EditorUi.prototype.extractGraphModelFromHtml=