Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"cells",[J])),b.fireEvent(new mxEventObject("freehandInserted","cell",J))}finally{b.model.endUpdate()}t&&b.setSelectionCells([J])}}for(J=0;J<k.length;J++)k[J].parentNode.removeChild(k[J]);c=null;k=[];x=[]}B(!1)};b.addListener(mxEvent.FIRE_MOUSE_EVENT,mxUtils.bind(this,function(C,J){C=J.getProperty("eventName");J=J.getProperty("event");C==mxEvent.MOUSE_MOVE&&g&&(null!=J.sourceState&&J.sourceState.setCursor("crosshair"),J.consume())}));b.addMouseListener({mouseDown:mxUtils.bind(this,function(C,J){if(b.isEnabled()&&
!b.isCellLocked(b.getDefaultParent())&&(C=J.getEvent(),g&&!mxEvent.isPopupTrigger(C)&&!mxEvent.isMultiTouchEvent(C))){var F=parseFloat(b.currentVertexStyle[mxConstants.STYLE_STROKEWIDTH]||1);F=Math.max(1,F*b.view.scale);var O=G();c=document.createElementNS("http://www.w3.org/2000/svg","path");c.setAttribute("fill",v?O:"none");c.setAttribute("stroke",O);c.setAttribute("stroke-width",F);"1"==b.currentVertexStyle[mxConstants.STYLE_DASHED]&&(O=b.currentVertexStyle[mxConstants.STYLE_DASH_PATTERN]||"3 3",
O=O.split(" ").map(function(S){return parseFloat(S)*F}).join(" "),c.setAttribute("stroke-dasharray",O));d=[];C=T(C);p(C);l="M"+C.x+" "+C.y;x.push(C);y=[];c.setAttribute("d",v?PerfectFreehand.getSvgPathFromStroke([[C.x,C.y]],u):l);e.appendChild(c);J.consume()}}),mouseMove:mxUtils.bind(this,function(C,J){if(c&&b.isEnabled()&&!b.isCellLocked(b.getDefaultParent())){C=J.getEvent();C=T(C);p(C);var F=q(0);if(F)if(x.push(F),v){var O=[];for(F=0;F<x.length;F++)O.push([x[F].x,x[F].y]);y=[];for(var S=2;S<d.length;S+=