Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxEvent.getClientX(S),mxEvent.getClientY(S)),f.start(S.x,S.y)):null!=da?this.addSelectionCells(da):1<this.getSelectionCount()&&this.isCellSelected(Q)&&this.removeSelectionCell(Q);da=null;U.consume()}}));this.connectionHandler.selectCells=function(S,U){this.graph.setSelectionCell(U||S)};this.connectionHandler.constraintHandler.isStateIgnored=function(S,U){var Q=S.view.graph;return U&&(Q.isCellSelected(S.cell)||Q.isTableRow(S.cell)&&Q.selectionCellsHandler.isHandled(Q.model.getParent(S.cell)))};this.selectionModel.addListener(mxEvent.CHANGE,