Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxEvent.getSource(g)==this.graph.container&&this.setDisplay("none")}));this.graph.addListener(mxEvent.START_EDITING,mxUtils.bind(this,function(g){this.reset()}));var b=this.graph.click;this.graph.click=mxUtils.bind(this,function(g){b.apply(this.graph,arguments);null==this.currentState||this.graph.isCellSelected(this.currentState.cell)||!mxEvent.isTouchEvent(g.getEvent())||this.graph.model.isVertex(g.getCell())||this.reset()});var e=!1;this.graph.addMouseListener({mouseDown:mxUtils.bind(this,function(g,
n){e=!1;g=n.getEvent();this.isResetEvent(g)?this.reset():this.isActive()||(n=this.getState(n.getState()),null==n&&mxEvent.isTouchEvent(g)||this.update(n));this.setDisplay("none")}),mouseMove:mxUtils.bind(this,function(g,n){g=n.getEvent();this.isResetEvent(g)?this.reset():this.graph.isMouseDown||mxEvent.isTouchEvent(g)||this.update(this.getState(n.getState()),n.getGraphX(),n.getGraphY());null!=this.graph.connectionHandler&&null!=this.graph.connectionHandler.shape&&(e=!0)}),mouseUp:mxUtils.bind(this,