Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxGraphHandler.prototype.mouseDown=function(a,b){this.mouseDownX=b.getX();this.mouseDownY=b.getY();a=b.getEvent();var c=mxEvent.isAltDown(a)&&mxEvent.isShiftDown(a)&&!this.graph.isSelectionEmpty();if(!b.isConsumed()&&this.isEnabled()&&this.graph.isEnabled()&&(null!=b.getState()||c)&&!mxEvent.isMultiTouchEvent(a)){var d=this.getInitialCellForEvent(b);this.delayedSelection=this.isDelayedSelection(d,b);this.cell=null;null==d&&c&&(d=this.graph.getSelectionCell());this.isSelectEnabled()&&!this.delayedSelection&&
this.graph.selectCellForEvent(d,a);this.isMoveEnabled()&&(this.delayedSelection?this.cell=d:this.start(d,b.getX(),b.getY()),this.cellWasClicked=!0,this.consumeMouseEvent(mxEvent.MOUSE_DOWN,b))}};