Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
v=mxEvent.getClientX(F);t.popupMenuHandler.hideMenu();mxEvent.consume(F)}));mxEvent.addGestureListeners(document.body,null,mxUtils.bind(this,function(F){var S=!1;null!=v&&(this.diagramContainer.style.width=Math.max(20,H+mxEvent.getClientX(F)-v)+"px",S=!0);null!=A&&(this.diagramContainer.style.height=Math.max(20,L+mxEvent.getClientY(F)-A)+"px",S=!0);S&&((window.opener||window.parent).postMessage(JSON.stringify({event:"resize",fullscreen:Editor.inlineFullscreen,rect:this.diagramContainer.getBoundingClientRect()}),
"*"),this.inlineSizeChanged(),this.refresh())}),function(F){null==v&&null==A||mxEvent.consume(F);A=v=null});document.body.style.backgroundColor="transparent";this.diagramContainer.style.borderRadius="4px";this.bottomResizer.style.visibility="hidden";this.rightResizer.style.visibility="hidden";this.sketchMenubarElt.style.display="none";g.style.visibility="hidden";d.style.visibility="hidden";n.style.display="none";this.addListener("editInlineStart",mxUtils.bind(this,function(F){this.inlineSizeChanged();