Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
L.beginUpdate();try{var P=null;P="stackLayout"==this.getCurrentCellStyle(x).childLayout?x:L.getParent(x);var X=L.getChildCells(P,!0);0==X.length?L.remove(P):(P==x&&(x=X[X.length-1]),L.remove(x))}finally{L.endUpdate()}};Graph.prototype.insertLane=function(x,L){var P=this.getModel();P.beginUpdate();try{var X=null;if("stackLayout"==this.getCurrentCellStyle(x).childLayout){X=x;var ea=P.getChildCells(X,!0);x=ea[L?0:ea.length-1]}else X=P.getParent(x);var la=X.getIndex(x);x=P.cloneCell(x,!1);x.value=null;