Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
xa),sa,this);this.fireEvent(new mxEventObject(mxEvent.CELLS_ADDED,"cells",sa))}finally{X.endUpdate()}return la};Graph.prototype.insertImage=function(x,L,P){if(null!=x&&null!=this.cellEditor.textarea){for(var X=this.cellEditor.textarea.getElementsByTagName("img"),ea=[],la=0;la<X.length;la++)ea.push(X[la]);document.execCommand("insertimage",!1,x);x=this.cellEditor.textarea.getElementsByTagName("img");if(x.length==ea.length+1)for(la=x.length-1;0<=la;la--)if(0==la||x[la]!=ea[la-1]){x[la].setAttribute("width",
L);x[la].setAttribute("height",P);break}}};Graph.prototype.insertLink=function(x){if(null!=this.cellEditor.textarea)if(0==x.length)document.execCommand("unlink",!1);else if(mxClient.IS_FF){for(var L=this.cellEditor.textarea.getElementsByTagName("a"),P=[],X=0;X<L.length;X++)P.push(L[X]);document.execCommand("createlink",!1,mxUtils.trim(x));L=this.cellEditor.textarea.getElementsByTagName("a");if(L.length==P.length+1)for(X=L.length-1;0<=X;X--)if(L[X]!=P[X-1]){for(L=L[X].getElementsByTagName("a");0<L.length;){for(P=