Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null==T.getTerminal(m[B],!0)){T.setTerminal(m[B],G,!0);var K=g.getCellGeometry(m[B]);K.points=null;null!=K.getTerminalPoint(!0)&&K.setTerminalPoint(null,!0)}}finally{T.endUpdate()}return m}}var L={67:d.actions.get("selectChildren"),88:d.actions.get("selectDescendants"),80:d.actions.get("selectParent"),83:d.actions.get("selectSiblings")},F=d.onKeyDown;d.onKeyDown=function(G){try{var P=g.getSelectionCell();if(g.isEnabled()&&!g.isEditing()&&null!=P){var O=mxEvent.isAltDown(G)&&mxEvent.isShiftDown(G)?
L[G.keyCode]:null;null!=O?(O.funct(G),mxEvent.consume(G)):c(P)&&(O=null,0<g.getIncomingTreeEdges(P).length&&(9==G.which?O=mxEvent.isShiftDown(G)?D(P):z(P):13==G.which&&(O=E(P,!mxEvent.isShiftDown(G)))),null!=O&&0<O.length?(1==O.length&&g.model.isEdge(O[0])?g.setSelectionCell(g.model.getTerminal(O[0],!1)):g.setSelectionCell(O[O.length-1]),null!=d.hoverIcons&&d.hoverIcons.update(g.view.getState(P)),g.startEditingAtCell(P),mxEvent.consume(G)):37==G.keyCode?(I(P,mxConstants.DIRECTION_WEST),mxEvent.consume(G)):
38==G.keyCode?(I(P,mxConstants.DIRECTION_NORTH),mxEvent.consume(G)):39==G.keyCode?(I(P,mxConstants.DIRECTION_EAST),mxEvent.consume(G)):40==G.keyCode&&(I(P,mxConstants.DIRECTION_SOUTH),mxEvent.consume(G)))}}catch(N){d.handleError(N)}mxEvent.isConsumed(G)||F.apply(this,arguments)};var S=g.connectVertex;g.connectVertex=function(G,P,O,N,T,m,B){var K=g.getIncomingTreeEdges(G);if(c(G)){var R=y(G),U=R==mxConstants.DIRECTION_EAST||R==mxConstants.DIRECTION_WEST,W=P==mxConstants.DIRECTION_EAST||P==mxConstants.DIRECTION_WEST;