Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.patchPage=function(b,e,f,c){var k=b==this.currentPage?this.editor.graph.model:new mxGraphModel(b.root),l=this.createParentLookup(k,e);k.beginUpdate();try{var x=k.updateEdgeParent,y=new mxDictionary,E=[];k.updateEdgeParent=function(t,u){!y.get(t)&&c&&(y.put(t,!0),E.push(t))};var D=l[""],z=null!=D&&null!=D.inserted?D.inserted[""]:null,M=null;null!=z&&(M=this.getCellForJson(z));if(null==M){var I=null!=D&&null!=D.moved?D.moved[""]:null;null!=I&&(M=k.getCell(I))}null!=M&&(k.setRoot(M),