Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
u.model.isVertex(l)&&u.isAutoSizeCell(l)&&u.updateCellSize(l)}finally{u.getModel().endUpdate()}u.scrollCellToVisible(l);u.setSelectionCell(l);u.container.focus();u.editAfterInsert&&u.startEditing(l);window.setTimeout(function(){null!=d.hoverIcons&&d.hoverIcons.update(u.view.getState(l))},0);return l},B=function(l,n,z,C,D){l=new mxCell(l,new mxGeometry(0,0,n,z),C);l.vertex=!0;null==D&&(D=u.getCenterInsertPoint(u.getBoundingBoxFromGeometry([l],!0)));l.geometry.x=D.x;l.geometry.y=D.y;return x(l)};d.actions.put("insertText",