Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(D){if(e.isEnabled()&&1==e.getSelectionCount()){var M=e.getSelectionCell(),K=mxEvent.isControlDown(D)?null:e.getIncomingTreeEdges(M);D=[];if(null!=K&&0<K.length&&(K=e.getOutgoingTreeEdges(e.model.getTerminal(K[0],!0)),null!=K))for(var O=0;O<K.length;O++)D.push(e.model.getTerminal(K[O],!1));0==D.length&&(D=e.model.getChildren(e.model.getParent(M)));e.setSelectionCells(D)}},null,null,"Alt+Shift+S");var p=e.removeCells;e.removeCells=function(D,M){M=null!=M?M:!0;null==D&&(D=this.getDeletableCells(this.getSelectionCells()));
M&&(D=this.getDeletableCells(this.addAllEdges(D)));for(var K=[],O=0;O<D.length;O++){var V=D[O];g.isEdge(V)&&v(V)&&(K.push(V),V=g.getTerminal(V,!1));if(d(V)){var k=[];e.traverse(V,!0,function(y,G){var P=null!=G&&e.isTreeEdge(G);P&&k.push(G);(null==G||P)&&k.push(y);return null==G||P});0<k.length&&(K=K.concat(k),V=e.getIncomingTreeEdges(D[O]),D=D.concat(V))}else null!=V&&K.push(D[O])}D=K;return p.apply(this,arguments)};c.hoverIcons.getStateAt=function(D,M,K){return d(D.cell)?null:this.graph.view.getState(this.graph.getCellAt(M,