Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
sa))}}finally{this.graph.model.endUpdate()}}else oa=new mxRectangle(this.x,this.y,this.width,this.height),this.graph.selectRegion(oa,L.getEvent());L.consume()}}};mxRubberband.prototype.mouseMove=function(x,L){if(!L.isConsumed()&&null!=this.first){var P=mxUtils.getScrollOrigin(this.graph.container);x=mxUtils.getOffset(this.graph.container);P.x-=x.x;P.y-=x.y;x=L.getX()+P.x;P=L.getY()+P.y;var X=this.first.x-x,ea=this.first.y-P,la=this.graph.tolerance;if(null!=this.div||Math.abs(X)>la||Math.abs(ea)>la)null==
this.div&&(this.div=this.createShape()),mxUtils.clearSelection(),this.update(x,P),this.isSpaceEvent(L)?(x=this.x+this.width,P=this.y+this.height,X=this.graph.view.scale,mxEvent.isAltDown(L.getEvent())||(this.width=this.graph.snap(this.width/X)*X,this.height=this.graph.snap(this.height/X)*X,this.graph.isGridEnabled()||(this.width<this.graph.tolerance&&(this.width=0),this.height<this.graph.tolerance&&(this.height=0)),this.x<this.first.x&&(this.x=x-this.width),this.y<this.first.y&&(this.y=P-this.height)),
this.div.style.borderStyle="dashed",this.div.style.backgroundColor="white",this.div.style.left=this.x+"px",this.div.style.top=this.y+"px",this.div.style.width=Math.max(0,this.width)+"px",this.div.style.height=this.graph.container.clientHeight+"px",this.div.style.borderWidth=0>=this.width?"0px 1px 0px 0px":"0px 1px 0px 1px",null==this.secondDiv&&(this.secondDiv=this.div.cloneNode(!0),this.div.parentNode.appendChild(this.secondDiv)),this.secondDiv.style.left=this.x+"px",this.secondDiv.style.top=this.y+
"px",this.secondDiv.style.width=this.graph.container.clientWidth+"px",this.secondDiv.style.height=Math.max(0,this.height)+"px",this.secondDiv.style.borderWidth=0>=this.height?"1px 0px 0px 0px":"1px 0px 1px 0px"):(this.div.style.backgroundColor="",this.div.style.borderWidth="",this.div.style.borderStyle="",null!=this.secondDiv&&(this.secondDiv.parentNode.removeChild(this.secondDiv),this.secondDiv=null)),L.consume()}};var ka=mxRubberband.prototype.reset;mxRubberband.prototype.reset=function(){null!=