Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxGraphHandler.prototype.mouseDown=function(a,b){this.mouseDownX=b.getX();this.mouseDownY=b.getY();!b.isConsumed()&&this.isEnabled()&&this.graph.isEnabled()&&null!=b.getState()&&!mxEvent.isMultiTouchEvent(b.getEvent())&&(a=this.getInitialCellForEvent(b),this.delayedSelection=this.isDelayedSelection(a,b),this.cell=null,this.isSelectEnabled()&&!this.delayedSelection&&this.graph.selectCellForEvent(a,b.getEvent()),this.isMoveEnabled()&&(this.delayedSelection?this.cell=a:this.start(a,b.getX(),b.getY()),
this.cellWasClicked=!0,this.consumeMouseEvent(mxEvent.MOUSE_DOWN,b)))};mxGraphHandler.prototype.getGuideStates=function(){var a=this.graph.getDefaultParent(),b=this.graph.getModel(),c=mxUtils.bind(this,function(d){return null!=this.graph.view.getState(d)&&b.isVertex(d)&&null!=b.getGeometry(d)&&!b.getGeometry(d).relative});return this.graph.view.getCellStates(b.filterDescendants(c,a))};mxGraphHandler.prototype.getCells=function(a){return!this.delayedSelection&&this.graph.isCellMovable(a)?[a]:this.graph.getMovableCells(this.graph.getSelectionCells())};