Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.init=function(b){mxGraph.prototype.init.apply(this,arguments);this.cellRenderer.initializeLabel=function(g,n){mxCellRenderer.prototype.initializeLabel.apply(this,arguments);var y=g.view.graph.tolerance,q=!0,E=null,N=mxUtils.bind(this,function(K){q=!0;E=new mxPoint(mxEvent.getClientX(K),mxEvent.getClientY(K))}),T=mxUtils.bind(this,function(K){q=q&&null!=E&&Math.abs(E.x-mxEvent.getClientX(K))<y&&Math.abs(E.y-mxEvent.getClientY(K))<y}),F=mxUtils.bind(this,function(K){if(q)for(var R=mxEvent.getSource(K);null!=
R&&R!=n.node;){if("a"==R.nodeName.toLowerCase()){g.view.graph.labelLinkClicked(g,R,K);break}R=R.parentNode}});mxEvent.addGestureListeners(n.node,N,T,F);mxEvent.addListener(n.node,"click",function(K){mxEvent.consume(K)})};if(null!=this.tooltipHandler){var e=this.tooltipHandler.init;this.tooltipHandler.init=function(){e.apply(this,arguments);null!=this.div&&mxEvent.addListener(this.div,"click",mxUtils.bind(this,function(g){var n=mxEvent.getSource(g);"A"==n.nodeName&&(n=n.getAttribute("href"),null!=
n&&this.graph.isCustomLink(n)&&(mxEvent.isTouchEvent(g)||!mxEvent.isPopupTrigger(g))&&this.graph.customLinkClicked(n)&&mxEvent.consume(g))}))}}this.addListener(mxEvent.SIZE,mxUtils.bind(this,function(g,n){null!=this.container&&this.flowAnimationStyle&&(g=this.flowAnimationStyle.getAttribute("id"),this.flowAnimationStyle.innerHTML=this.getFlowAnimationStyleCss(g))}));this.initLayoutManager()};