Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
urlParams["remote-selection"]){var Q=null!=b.currentPage?b.currentPage.getId():null;if(null==Q||null!=W.pageId&&W.pageId==Q){m();for(m=0;m<W.removed.length;m++){var V=W.removed[m];if(null!=V){var X=U[V];delete U[V];null!=X&&X.destroy()}}for(m=0;m<W.added.length;m++)if(V=W.added[m],null!=V){var Y=z.model.getCell(V);null!=Y&&(U[V]=z.highlightCell(Y,g[K].color,6E4,70,3))}}}}e.file.fireEvent(new mxEventObject("realtimeMessage","message",N))}}catch(Z){null!=window.console&&console.warn(Z,N,T)}}function y(N,
T){if(!C&&SimplePeer.WEBRTC_SUPPORT){var m=new SimplePeer({initiator:T,config:{iceServers:[{urls:"stun:54.89.235.160:3478"}]}});m.on("signal",function(B){O("sendSignal",{to:N,from:H,signal:B})});m.on("error",function(B){delete L[N];EditorUi.debug("P2PCollab: p2p socket error",B);!q&&T&&m.destroyed&&v[N]&&(EditorUi.debug("P2PCollab: p2p socket reconnecting",N),y(N,!0))});m.on("connect",function(){delete L[N];null==F[N]||F[N].destroyed?(F[N]=m,v[N]=!0,EditorUi.debug("P2PCollab: p2p socket connected",
N)):(m.noP2PMapDel=!0,m.destroy(),EditorUi.debug("P2PCollab: p2p socket duplicate",N))});m.on("close",function(){m.noP2PMapDel||(EditorUi.debug("P2PCollab: p2p socket closed",N),D(u[N]),delete F[N])});m.on("data",x);return L[N]=m}}function E(N,T){D(T||u[N]);null!=N&&(delete u[N],v[N]=!1)}function D(N){var T=g[N];if(null!=T){var m=T.selection,B;for(B in m)null!=m[B]&&m[B].destroy();null!=T.cursor&&null!=T.cursor.parentNode&&T.cursor.parentNode.removeChild(T.cursor);clearTimeout(T.inactiveTO);delete g[N]}}