Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"keys",Da,"values",Qa,"cells",ca.getSelectionCells()))}finally{ca.getModel().endUpdate()}}function U(oa,sa,va){var Ea=mxUtils.getOffset(m,!0),Da=mxUtils.getOffset(oa,!0);sa.style.position="absolute";sa.style.left=Da.x-Ea.x+"px";sa.style.top=Da.y-Ea.y+"px";sa.style.width=oa.offsetWidth+"px";sa.style.height=oa.offsetHeight-(va?4:0)+"px";sa.style.zIndex=5}function W(oa,sa,va){var Ea=document.createElement("div");Ea.style.width="32px";Ea.style.height="4px";Ea.style.margin="2px";Ea.style.border="1px solid black";