Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
J.vertex=!0;R.addCell(J);R.dblClick=function(C,D){if(null!=D&&D!=J)R.setSelectionCell(D);else{D=mxUtils.convertPoint(R.container,mxEvent.getClientX(C),mxEvent.getClientY(C));mxEvent.consume(C);C=R.view.scale;var M=R.view.translate;R.setSelectionCell(v((D.x-3*C)/C-M.x,(D.y-3*C)/C-M.y))}};u=new mxKeyHandler(R);u.bindKey(46,E);u.bindKey(8,E);R.getRubberband().isForceRubberbandEvent=function(C){return 0==C.evt.button&&(null==C.getCell()||C.getCell()==J)};R.panningHandler.isForcePanningEvent=function(C){return 2==