Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxConstants.HANDLE_STROKECOLOR)};var Da=mxVertexHandler.prototype.createSizerShape;mxVertexHandler.prototype.createSizerShape=function(x,L,P,X){X=L==mxEvent.ROTATION_HANDLE?HoverIcons.prototype.rotationHandle:L==mxEvent.LABEL_HANDLE?this.secondaryHandleImage:X;return Da.apply(this,arguments)};var Ba=mxGraphHandler.prototype.getBoundingBox;mxGraphHandler.prototype.getBoundingBox=function(x){if(null!=x&&1==x.length){var L=this.graph.getModel(),P=L.getParent(x[0]),X=this.graph.getCellGeometry(x[0]);