Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
161==c.charCodeAt(4)&&177==c.charCodeAt(5)&&26==c.charCodeAt(6)&&225==c.charCodeAt(7)||60==c.charCodeAt(0)&&63==c.charCodeAt(1)&&120==c.charCodeAt(2)&&109==c.charCodeAt(3)&&108==c.charCodeAt(3))};var b=EditorUi.prototype.createKeyHandler;EditorUi.prototype.createKeyHandler=function(c){var e=b.apply(this,arguments);if(!this.editor.chromeless||this.editor.editable){var g=e.getFunction,q=this.editor.graph,p=this;e.getFunction=function(t){if(q.isSelectionEmpty()&&null!=p.pages&&0<p.pages.length){var x=
p.getSelectedPageIndex();if(mxEvent.isShiftDown(t)){if(37==t.keyCode)return function(){0<x&&p.movePage(x,x-1)};if(38==t.keyCode)return function(){0<x&&p.movePage(x,0)};if(39==t.keyCode)return function(){x<p.pages.length-1&&p.movePage(x,x+1)};if(40==t.keyCode)return function(){x<p.pages.length-1&&p.movePage(x,p.pages.length-1)}}else if(mxEvent.isControlDown(t)||mxClient.IS_MAC&&mxEvent.isMetaDown(t)){if(37==t.keyCode)return function(){0<x&&p.selectNextPage(!1)};if(38==t.keyCode)return function(){0<
x&&p.selectPage(p.pages[0])};if(39==t.keyCode)return function(){x<p.pages.length-1&&p.selectNextPage(!0)};if(40==t.keyCode)return function(){x<p.pages.length-1&&p.selectPage(p.pages[p.pages.length-1])}}}return!(65<=t.keyCode&&90>=t.keyCode)||q.isSelectionEmpty()||mxEvent.isAltDown(t)||mxEvent.isShiftDown(t)||mxEvent.isControlDown(t)||mxClient.IS_MAC&&mxEvent.isMetaDown(t)?g.apply(this,arguments):null}}return e};var f=EditorUi.prototype.extractGraphModelFromHtml;EditorUi.prototype.extractGraphModelFromHtml=