Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
L){var P=this.graph.getModel(),X=P.getParent(this.state.cell),ea=this.graph.getCellGeometry(this.state.cell);(this.getHandleForEvent(L)==mxEvent.ROTATION_HANDLE||!P.isEdge(X)||null==ea||!ea.relative||null==this.state||2<=this.state.width||2<=this.state.height)&&Qa.apply(this,arguments)};mxVertexHandler.prototype.rotateClick=function(){var x=mxUtils.getValue(this.state.style,mxConstants.STYLE_STROKECOLOR,mxConstants.NONE),L=mxUtils.getValue(this.state.style,mxConstants.STYLE_FILLCOLOR,mxConstants.NONE);
this.state.view.graph.model.isVertex(this.state.cell)&&x==mxConstants.NONE&&L==mxConstants.NONE?(x=mxUtils.mod(mxUtils.getValue(this.state.style,mxConstants.STYLE_ROTATION,0)+90,360),this.state.view.graph.setCellStyles(mxConstants.STYLE_ROTATION,x,[this.state.cell])):this.state.view.graph.turnShapes([this.state.cell])};var Ta=mxVertexHandler.prototype.mouseMove;mxVertexHandler.prototype.mouseMove=function(x,L){Ta.apply(this,arguments);null!=this.graph.graphHandler.first&&(null!=this.rotationShape&&