Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.setTableRowHeight=function(b,e,g){g=null!=g?g:!0;var n=this.getModel();n.beginUpdate();try{var y=this.getCellGeometry(b);if(null!=y){y=y.clone();y.height+=e;n.setGeometry(b,y);var q=n.getParent(b),E=n.getChildCells(q,!0);if(!g){var N=mxUtils.indexOf(E,b);if(N<E.length-1){var T=E[N+1],F=this.getCellGeometry(T);null!=F&&(F=F.clone(),F.y+=e,F.height-=e,n.setGeometry(T,F))}}var K=this.getCellGeometry(q);null!=K&&(g||(g=b==E[E.length-1]),g&&(K=K.clone(),K.height+=e,n.setGeometry(q,K)))}}finally{n.endUpdate()}};