Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.init=function(){var b=this.editor.graph;if(!b.standalone){"0"!=urlParams["shape-picker"]&&this.installShapePicker();mxEvent.addListener(b.container,"scroll",mxUtils.bind(this,function(){b.tooltipHandler.hide();null!=b.connectionHandler&&null!=b.connectionHandler.constraintHandler&&b.connectionHandler.constraintHandler.reset()}));b.addListener(mxEvent.ESCAPE,mxUtils.bind(this,function(){b.tooltipHandler.hide();var n=b.getRubberband();null!=n&&n.cancel()}));mxEvent.addListener(b.container,
"keydown",mxUtils.bind(this,function(n){this.onKeyDown(n)}));mxEvent.addListener(b.container,"keypress",mxUtils.bind(this,function(n){this.onKeyPress(n)}));this.addUndoListener();this.addBeforeUnloadListener();b.getSelectionModel().addListener(mxEvent.CHANGE,mxUtils.bind(this,function(){this.updateActionStates()}));b.getModel().addListener(mxEvent.CHANGE,mxUtils.bind(this,function(){this.updateActionStates()}));var e=b.setDefaultParent,g=this;this.editor.graph.setDefaultParent=function(){e.apply(this,
arguments);g.updateActionStates()};b.editLink=g.actions.get("editLink").funct;this.updateActionStates();this.initClipboard();this.initCanvas();null!=this.format&&this.format.init()}};EditorUi.prototype.clearSelectionState=function(){this.selectionState=null};EditorUi.prototype.getSelectionState=function(){null==this.selectionState&&(this.selectionState=this.createSelectionState());return this.selectionState};