Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
J.evt.button};var d=M.isCellSelectable;M.isCellSelectable=function(J){return J==I?!1:d.apply(this,arguments)};M.getLinkForCell=function(){return null};var g=M.view.getState(I);z=M.getAllConnectionConstraints(g);for(var n=0;null!=z&&n<z.length;n++){var t=M.getConnectionPoint(g,z[n]);l(t.x-3,t.y-3,z[n])}M.fit(8);M.center();n=b.createToolbarButton(Editor.zoomInImage,mxResources.get("zoomIn"),function(){M.zoomIn()},20);n.setAttribute("disabled","disabled");t=b.createToolbarButton(Editor.zoomOutImage,