Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.editor.graph.getSelectionModel().addListener(mxEvent.CHANGE,mxUtils.bind(this,function(K,O){0<this.editor.graph.getSelectionCount()?(K=this.editor.graph.getSelectionCell(),K=this.editor.graph.getModel().getStyle(K),this.styleInput.value=K||"",this.styleInput.style.visibility="visible"):this.styleInput.style.visibility="hidden"})));var D=this.isSelectionAllowed;this.isSelectionAllowed=function(K){return mxEvent.getSource(K)==this.styleInput?!0:D.apply(this,arguments)}}C=document.getElementById("geInfo");