Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxVertexHandler.prototype.getSelectionBounds=function(x){var L=this.graph.getModel(),P=L.getParent(x.cell),X=this.graph.getCellGeometry(x.cell);return L.isEdge(P)&&null!=X&&X.relative&&2>x.width&&2>x.height&&null!=x.text&&null!=x.text.boundingBox?(L=x.text.unrotatedBoundingBox||x.text.boundingBox,new mxRectangle(Math.round(L.x),Math.round(L.y),Math.round(L.width),Math.round(L.height))):Oa.apply(this,arguments)};var Qa=mxVertexHandler.prototype.mouseDown;mxVertexHandler.prototype.mouseDown=function(x,