Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
C.evt.button};var c=R.isCellSelectable;R.isCellSelectable=function(C){return C==J?!1:c.apply(this,arguments)};R.getLinkForCell=function(){return null};var e=R.view.getState(J);H=R.getAllConnectionConstraints(e);for(var g=0;null!=H&&g<H.length;g++){var q=R.getConnectionPoint(e,H[g]);v(q.x-3,q.y-3,H[g])}R.fit(8);R.center();g=b.createToolbarButton(Editor.zoomInImage,mxResources.get("zoomIn"),function(){R.zoomIn()},20);g.setAttribute("disabled","disabled");q=b.createToolbarButton(Editor.zoomOutImage,