Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"";W.style.textOverflow="";W.style.whiteSpace="";W.style.cursor="text";W.style.color="";W.setAttribute("contentEditable","true");mxUtils.setPrefixedStyle(W.style,"user-select","text");W.focus();document.execCommand("selectAll",!1,null);t=function(){W.removeAttribute("contentEditable");W.style.cursor="pointer";X.title=W.innerHTML;V()};mxEvent.consume(ha)}};mxEvent.addListener(W,"click",U);mxEvent.addListener(P,"dblclick",U);c.appendChild(P);mxEvent.addListener(P,"dragstart",function(ha){null==S&&null!=