Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(){var G=q.getSelectionCell()||q.getModel().getRoot();q.isEnabled()&&null!=G&&(G=G.cloneValue(),null==G||isNaN(G.nodeType)||(n.copiedValue=G))},null,null,"Alt+Shift+B");this.addAction("pasteData",function(G,L){function R(f,l){var u=V.getValue(f);l=f.cloneValue(l);l.removeAttribute("placeholders");null==u||isNaN(u.nodeType)||l.setAttribute("placeholders",u.getAttribute("placeholders"));null!=G&&mxEvent.isShiftDown(G)||l.setAttribute("label",q.convertValueToString(f));V.setValue(f,l)}G=null!=