Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.editor.graph.getSelectionModel().addListener(mxEvent.CHANGE,mxUtils.bind(this,function(O,N){0<this.editor.graph.getSelectionCount()?(O=this.editor.graph.getSelectionCell(),O=this.editor.graph.getModel().getStyle(O),this.styleInput.value=O||"",this.styleInput.style.visibility="visible"):this.styleInput.style.visibility="hidden"})));var G=this.isSelectionAllowed;this.isSelectionAllowed=function(O){return mxEvent.getSource(O)==this.styleInput?!0:G.apply(this,arguments)}}J=document.getElementById("geInfo");