Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.bind(this,function(){});this.inlineSizeChanged()};EditorUi.prototype.installImagePasteHandler=function(){if(!mxClient.IS_IE){var d=this.editor.graph;d.container.addEventListener("paste",mxUtils.bind(this,function(f){if(!mxEvent.isConsumed(f))try{for(var l=f.clipboardData||f.originalEvent.clipboardData,u=!1,A=0;A<l.types.length;A++)if("text/"===l.types[A].substring(0,5)){u=!0;break}if(!u){var B=l.items;for(index in B){var F=B[index];if("file"===F.kind){if(d.isEditing())this.importFiles([F.getAsFile()],
0,0,this.maxImageSize,function(O,H,ja,da,ca,ia){d.insertImage(O,ca,ia)},function(){},function(O){return"image/"==O.type.substring(0,6)},function(O){for(var H=0;H<O.length;H++)O[H]()});else{var M=this.editor.graph.getInsertPoint();this.importFiles([F.getAsFile()],M.x,M.y,this.maxImageSize);mxEvent.consume(f)}break}}}}catch(O){}}),!1)}};EditorUi.prototype.installNativeClipboardHandler=function(){function d(){window.setTimeout(function(){l.innerHTML="&nbsp;";l.focus();document.execCommand("selectAll",