Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null==V.getTerminal(k[y],!0)){V.setTerminal(k[y],D,!0);var G=e.getCellGeometry(k[y]);G.points=null;null!=G.getTerminalPoint(!0)&&G.setTerminalPoint(null,!0)}}finally{V.endUpdate()}return k}}var I={67:c.actions.get("selectChildren"),88:c.actions.get("selectDescendants"),80:c.actions.get("selectParent"),83:c.actions.get("selectSiblings")},A=c.onKeyDown;c.onKeyDown=function(D){try{var M=e.getSelectionCell();if(e.isEnabled()&&!e.isEditing()&&null!=M){var K=mxEvent.isAltDown(D)&&mxEvent.isShiftDown(D)?
I[D.keyCode]:null;null!=K?(K.funct(D),mxEvent.consume(D)):d(M)&&(K=null,0<e.getIncomingTreeEdges(M).length&&(9==D.which?K=mxEvent.isShiftDown(D)?N(M):H(M):13==D.which&&(K=L(M,!mxEvent.isShiftDown(D)))),null!=K&&0<K.length?(1==K.length&&e.model.isEdge(K[0])?e.setSelectionCell(e.model.getTerminal(K[0],!1)):e.setSelectionCell(K[K.length-1]),null!=c.hoverIcons&&c.hoverIcons.update(e.view.getState(M)),e.startEditingAtCell(M),mxEvent.consume(D)):37==D.keyCode?(J(M,mxConstants.DIRECTION_WEST),mxEvent.consume(D)):
38==D.keyCode?(J(M,mxConstants.DIRECTION_NORTH),mxEvent.consume(D)):39==D.keyCode?(J(M,mxConstants.DIRECTION_EAST),mxEvent.consume(D)):40==D.keyCode&&(J(M,mxConstants.DIRECTION_SOUTH),mxEvent.consume(D)))}}catch(O){c.handleError(O)}mxEvent.isConsumed(D)||A.apply(this,arguments)};var S=e.connectVertex;e.connectVertex=function(D,M,K,O,V,k,y){var G=e.getIncomingTreeEdges(D);if(d(D)){var P=F(D),Q=P==mxConstants.DIRECTION_EAST||P==mxConstants.DIRECTION_WEST,U=M==mxConstants.DIRECTION_EAST||M==mxConstants.DIRECTION_WEST;