Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"");this.blockDelayedSelection=null};var Aa=mxVertexHandler.prototype.init;mxVertexHandler.prototype.init=function(){Aa.apply(this,arguments);var x=!1;null!=this.rotationShape&&this.rotationShape.node.setAttribute("title",mxResources.get("rotateTooltip"));if(this.graph.isTable(this.state.cell)&&this.graph.isCellMovable(this.state.cell))this.refreshMoveHandles();else if(1==this.graph.getSelectionCount()&&this.graph.isCellMovable(this.state.cell)&&(this.graph.isTableCell(this.state.cell)||this.graph.isTableRow(this.state.cell))){this.cornerHandles=
[];for(var L=0;4>L;L++){var P=new mxRectangleShape(new mxRectangle(0,0,6,6),"#ffffff",mxConstants.HANDLE_STROKECOLOR);P.dialect=mxConstants.DIALECT_SVG;P.init(this.graph.view.getOverlayPane());this.cornerHandles.push(P)}}var X=mxUtils.bind(this,function(){null!=this.specialHandle&&(this.specialHandle.node.style.display=this.graph.isEnabled()&&this.graph.getSelectionCount()<this.graph.graphHandler.maxCells?"":"none");this.redrawHandles()});this.changeHandler=mxUtils.bind(this,function(ea,la){this.updateLinkHint(this.graph.getLinkForCell(this.state.cell),
this.graph.getLinksForState(this.state));X()});this.graph.getSelectionModel().addListener(mxEvent.CHANGE,this.changeHandler);this.graph.getModel().addListener(mxEvent.CHANGE,this.changeHandler);this.editingHandler=mxUtils.bind(this,function(ea,la){this.redrawHandles()});this.graph.addListener(mxEvent.EDITING_STOPPED,this.editingHandler);L=this.graph.getLinkForCell(this.state.cell);P=this.graph.getLinksForState(this.state);this.updateLinkHint(L,P);if(null!=L||null!=P&&0<P.length)x=!0;x&&this.redrawHandles()};