Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
g);var q=this.hoverIcons.drag;this.hoverIcons.drag=function(){e.hideShapePicker();q.apply(this,arguments)};var E=this.hoverIcons.execute;this.hoverIcons.execute=function(S,G,L){var R=L.getEvent();this.graph.isCloneEvent(R)||mxEvent.isShiftDown(R)?E.apply(this,arguments):this.graph.connectVertex(S.cell,G,this.graph.defaultEdgeLength,R,null,null,mxUtils.bind(this,function(V,d,f){var l=b.getCompositeParent(S.cell);V=b.getCellGeometry(l);for(L.consume();null!=l&&b.model.isVertex(l)&&null!=V&&V.relative;)cell=
l,l=b.model.getParent(cell),V=b.getCellGeometry(l);window.setTimeout(mxUtils.bind(this,function(){e.showShapePicker(L.getGraphX(),L.getGraphY(),l,mxUtils.bind(this,function(u){f(u);null!=e.hoverIcons&&e.hoverIcons.update(b.view.getState(u))}),G)}),30)}),mxUtils.bind(this,function(V){this.graph.selectCellsForConnectVertex(V,R,this)}))};var K=null;this.hoverIcons.addListener("focus",mxUtils.bind(this,function(S,G){null!=K&&window.clearTimeout(K);K=window.setTimeout(mxUtils.bind(this,function(){var L=