Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxConstraintHandler.prototype.update=function(x,L){this.isKeepFocusEvent(x)||!mxEvent.isAltDown(x.getEvent())?z.apply(this,arguments):this.reset()};mxGuide.prototype.createGuideShape=function(x){return new mxPolyline([],mxConstants.GUIDE_COLOR,mxConstants.GUIDE_STROKEWIDTH)};mxCellEditor.prototype.escapeCancelsEditing=!1;var A=mxCellEditor.prototype.startEditing;mxCellEditor.prototype.startEditing=function(x,L){x=this.graph.getStartEditingCell(x,L);A.apply(this,arguments);var P=this.graph.view.getState(x);