Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.updateSelectionStateForTableCells=function(b){if(1<b.cells.length&&b.cell){var e=mxUtils.sortCells(b.cells),g=this.editor.graph.model,n=g.getParent(e[0]),y=g.getParent(n);if(null!=n&&null!=y){for(var q=n.getIndex(e[0]),E=y.getIndex(n),K=null,S=1,G=1,L=0,R=E<y.getChildCount()-1?g.getChildAt(g.getChildAt(y,E+1),q):null;L<e.length-1;){var V=e[++L];null==R||R!=V||null!=K&&S!=K||(K=S,S=0,G++,n=g.getParent(R),R=E+G<y.getChildCount()?g.getChildAt(g.getChildAt(y,E+G),q):null);var d=this.editor.graph.view.getState(V);
if(V==g.getChildAt(n,q+S)&&null!=d&&1==mxUtils.getValue(d.style,"colspan",1)&&1==mxUtils.getValue(d.style,"rowspan",1))S++;else break}L==G*S-1&&(b.mergeCell=e[0],b.colspan=S,b.rowspan=G)}}};EditorUi.prototype.windowResized=function(){window.setTimeout(mxUtils.bind(this,function(){null!=this.editor.graph&&this.refresh()}),0)};