Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.onKeyDown=function(b){var e=this.editor.graph;if(9==b.which&&e.isEnabled()&&!mxEvent.isControlDown(b)){if(e.isEditing())if(mxEvent.isAltDown(b))e.stopEditing(!1);else try{var g=e.cellEditor.isContentEditing()&&e.cellEditor.isTextSelected();if(window.getSelection&&e.cellEditor.isContentEditing()&&!g&&!mxClient.IS_IE&&!mxClient.IS_IE11){var n=window.getSelection(),y=0<n.rangeCount?n.getRangeAt(0).commonAncestorContainer:null;g=null!=y&&("LI"==y.nodeName||null!=y.parentNode&&"LI"==
y.parentNode.nodeName)}g?document.execCommand(mxEvent.isShiftDown(b)?"outdent":"indent",!1,null):mxEvent.isShiftDown(b)?e.stopEditing(!1):e.cellEditor.insertTab(e.cellEditor.isContentEditing()?null:4)}catch(q){}else mxEvent.isAltDown(b)?e.selectParentCell():e.selectCell(!mxEvent.isShiftDown(b));mxEvent.consume(b)}};