Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
M&&(D=this.getDeletableCells(this.addAllEdges(D)));for(var K=[],O=0;O<D.length;O++){var V=D[O];g.isEdge(V)&&v(V)&&(K.push(V),V=g.getTerminal(V,!1));if(d(V)){var k=[];e.traverse(V,!0,function(y,G){var P=null!=G&&e.isTreeEdge(G);P&&k.push(G);(null==G||P)&&k.push(y);return null==G||P});0<k.length&&(K=K.concat(k),V=e.getIncomingTreeEdges(D[O]),D=D.concat(V))}else null!=V&&K.push(D[O])}D=K;return p.apply(this,arguments)};c.hoverIcons.getStateAt=function(D,M,K){return d(D.cell)?null:this.graph.view.getState(this.graph.getCellAt(M,
K))};var t=e.duplicateCells;e.duplicateCells=function(D,M){D=null!=D?D:this.getSelectionCells();for(var K=D.slice(0),O=0;O<K.length;O++){var V=e.view.getState(K[O]);if(null!=V&&d(V.cell)){var k=e.getIncomingTreeEdges(V.cell);for(V=0;V<k.length;V++)mxUtils.remove(k[V],D)}}this.model.beginUpdate();try{var y=t.call(this,D,M);if(y.length==D.length)for(O=0;O<D.length;O++)if(d(D[O])){var G=e.getIncomingTreeEdges(y[O]);k=e.getIncomingTreeEdges(D[O]);if(0==G.length&&0<k.length){var P=this.cloneCell(k[0]);