Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ArrangePanel.prototype.addGroupOps = function(div)
{
	var ui = this.editorUi;
	var ss = ui.getSelectionState();
	
	div.style.paddingTop = '8px';
	div.style.paddingBottom = '6px';

	var count = 0;
	
	if (!ss.cell && !ss.row)
	{
		count += this.addActions(div, ['group', 'ungroup',
			'copySize', 'pasteSize', 'swap']) +
			this.addActions(div, ['removeFromGroup']);
	}

	var clearWaypoints = this.addAction(div, 'clearWaypoints');

	if (clearWaypoints != null)
	{
		mxUtils.br(div);
		clearWaypoints.setAttribute('title', mxResources.get('clearWaypoints') +
			' (' + this.editorUi.actions.get('clearWaypoints').shortcut + ')' +
			' Shift+Click to Clear Anchor Points');
		count++;
	}

	count += this.addActions(div, ['lockUnlock']);

	if (count == 0)
	{
		div.style.display = 'none';
	}
	
	return div;
};