Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.setTableRowHeight=function(b,e,g){g=null!=g?g:!0;var n=this.getModel();n.beginUpdate();try{var y=this.getCellGeometry(b);if(null!=y){y=y.clone();y.height+=e;n.setGeometry(b,y);var q=n.getParent(b),E=n.getChildCells(q,!0);if(!g){var K=mxUtils.indexOf(E,b);if(K<E.length-1){var S=E[K+1],G=this.getCellGeometry(S);null!=G&&(G=G.clone(),G.y+=e,G.height-=e,n.setGeometry(S,G))}}var L=this.getCellGeometry(q);null!=L&&(g||(g=b==E[E.length-1]),g&&(L=L.clone(),L.height+=e,n.setGeometry(q,L)))}}finally{n.endUpdate()}};