Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.hideDialog=function(b,e,g){null!=this.dialogs&&0<this.dialogs.length&&(null==g||g==this.dialog.container.firstChild)&&(g=this.dialogs.pop(),0==g.close(b,e)?this.dialogs.push(g):(this.dialog=0<this.dialogs.length?this.dialogs[this.dialogs.length-1]:null,this.editor.fireEvent(new mxEventObject("hideDialog")),null==this.dialog&&null!=this.editor.graph.container&&"hidden"!=this.editor.graph.container.style.visibility&&window.setTimeout(mxUtils.bind(this,function(){null!=this.editor&&
(this.editor.graph.isEditing()&&null!=this.editor.graph.cellEditor.textarea?this.editor.graph.cellEditor.textarea.focus():(mxUtils.clearSelection(),this.editor.graph.container.focus()))}),0)))};EditorUi.prototype.ctrlEnter=function(){var b=this.editor.graph;if(b.isEnabled())try{for(var e=b.getSelectionCells(),g=new mxDictionary,n=[],y=0;y<e.length;y++){var q=b.isTableCell(e[y])?b.model.getParent(e[y]):e[y];null==q||g.get(q)||(g.put(q,!0),n.push(q))}b.setSelectionCells(b.duplicateCells(n,!1))}catch(E){this.handleError(E)}};