Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
I.vertex=!0;M.addCell(I);M.dblClick=function(J,G){if(null!=G&&G!=I)M.setSelectionCell(G);else{G=mxUtils.convertPoint(M.container,mxEvent.getClientX(J),mxEvent.getClientY(J));mxEvent.consume(J);J=M.view.scale;var P=M.view.translate;M.setSelectionCell(l((G.x-3*J)/J-P.x,(G.y-3*J)/J-P.y))}};k=new mxKeyHandler(M);k.bindKey(46,x);k.bindKey(8,x);M.getRubberband().isForceRubberbandEvent=function(J){return 0==J.evt.button&&(null==J.getCell()||J.getCell()==I)};M.panningHandler.isForcePanningEvent=function(J){return 2==