Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"cells",[J])),b.fireEvent(new mxEventObject("freehandInserted","cell",J))}finally{b.model.endUpdate()}t&&b.setSelectionCells([J])}}for(J=0;J<k.length;J++)k[J].parentNode.removeChild(k[J]);c=null;k=[];x=[]}A(!1)};b.addListener(mxEvent.FIRE_MOUSE_EVENT,mxUtils.bind(this,function(C,J){C=J.getProperty("eventName");J=J.getProperty("event");C==mxEvent.MOUSE_MOVE&&g&&(null!=J.sourceState&&J.sourceState.setCursor("crosshair"),J.consume())}));b.addMouseListener({mouseDown:mxUtils.bind(this,function(C,J){if(b.isEnabled()&&
!b.isCellLocked(b.getDefaultParent())&&(C=J.getEvent(),g&&!mxEvent.isPopupTrigger(C)&&!mxEvent.isMultiTouchEvent(C))){var G=parseFloat(b.currentVertexStyle[mxConstants.STYLE_STROKEWIDTH]||1);G=Math.max(1,G*b.view.scale);var P=F();c=document.createElementNS("http://www.w3.org/2000/svg","path");c.setAttribute("fill",v?P:"none");c.setAttribute("stroke",P);c.setAttribute("stroke-width",G);"1"==b.currentVertexStyle[mxConstants.STYLE_DASHED]&&(P=b.currentVertexStyle[mxConstants.STYLE_DASH_PATTERN]||"3 3",
P=P.split(" ").map(function(O){return parseFloat(O)*G}).join(" "),c.setAttribute("stroke-dasharray",P));d=[];C=S(C);p(C);l="M"+C.x+" "+C.y;x.push(C);y=[];c.setAttribute("d",v?PerfectFreehand.getSvgPathFromStroke([[C.x,C.y]],u):l);e.appendChild(c);J.consume()}}),mouseMove:mxUtils.bind(this,function(C,J){if(c&&b.isEnabled()&&!b.isCellLocked(b.getDefaultParent())){C=J.getEvent();C=S(C);p(C);var G=q(0);if(G)if(x.push(G),v){var P=[];for(G=0;G<x.length;G++)P.push([x[G].x,x[G].y]);y=[];for(var O=2;O<d.length;O+=