Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
m[1].geometry.width)/2:(U.x+U.width)/Q-W.x+-B.x+10,m[1].geometry.y-=m[1].geometry.height+B.y+40):(m[1].geometry.x=T==mxConstants.DIRECTION_WEST?m[1].geometry.x-(m[1].geometry.width+B.x+40):m[1].geometry.x+(m[1].geometry.width-B.x+40),m[1].geometry.y=null==U?G.geometry.y+(G.geometry.height-m[1].geometry.height)/2:(U.y+U.height)/Q-W.y+-B.y+10);return g.addCells(m,O)}finally{g.model.endUpdate()}}function M(G,P,O){G=g.getOutgoingTreeEdges(G);O=g.view.getState(O);var N=[];if(null!=O&&null!=G){for(var T=
0;T<G.length;T++){var m=g.view.getState(g.model.getTerminal(G[T],!1));null!=m&&(!P&&Math.min(m.x+m.width,O.x+O.width)>=Math.max(m.x,O.x)||P&&Math.min(m.y+m.height,O.y+O.height)>=Math.max(m.y,O.y))&&N.push(m)}N.sort(function(B,K){return P?B.x+B.width-K.x-K.width:B.y+B.height-K.y-K.height})}return N}function I(G,P){var O=y(G),N=P==mxConstants.DIRECTION_EAST||P==mxConstants.DIRECTION_WEST;(O==mxConstants.DIRECTION_EAST||O==mxConstants.DIRECTION_WEST)==N&&O!=P?d.actions.get("selectParent").funct():O==