Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
g);var q=this.hoverIcons.drag;this.hoverIcons.drag=function(){e.hideShapePicker();q.apply(this,arguments)};var E=this.hoverIcons.execute;this.hoverIcons.execute=function(S,G,L){var R=L.getEvent();this.graph.isCloneEvent(R)||mxEvent.isShiftDown(R)?E.apply(this,arguments):this.graph.connectVertex(S.cell,G,this.graph.defaultEdgeLength,R,null,null,mxUtils.bind(this,function(V,d,f){var l=b.getCompositeParent(S.cell);V=b.getCellGeometry(l);for(L.consume();null!=l&&b.model.isVertex(l)&&null!=V&&V.relative;)cell=