Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
HoverIcons.prototype.update=function(b,e,g){if(!this.graph.connectionArrowsEnabled||null!=this.graph.freehand&&this.graph.freehand.isDrawing()||null!=b&&"0"==mxUtils.getValue(b.style,"allowArrows","1"))this.reset();else{null!=b&&null!=b.cell.geometry&&b.cell.geometry.relative&&this.graph.model.isEdge(b.cell.parent)&&(b=null);var n=null;this.prev!=b||this.isActive()?(this.startTime=(new Date).getTime(),this.prev=b,n=0,null!=this.updateThread&&window.clearTimeout(this.updateThread),null!=b&&(this.updateThread=
window.setTimeout(mxUtils.bind(this,function(){this.isActive()||this.graph.isMouseDown||this.graph.panningHandler.isActive()||(this.prev=b,this.update(b,e,g))}),this.updateDelay+10))):null!=this.startTime&&(n=(new Date).getTime()-this.startTime);this.setDisplay("");null!=this.currentState&&this.currentState!=b&&n<this.activationDelay&&null!=this.bbox&&!mxUtils.contains(this.bbox,e,g)?this.reset(!1):(null!=this.currentState||n>this.activationDelay)&&this.currentState!=b&&(n>this.updateDelay&&null!=
b||null==this.bbox||null==e||null==g||!mxUtils.contains(this.bbox,e,g))&&(null!=b&&this.graph.isEnabled()?(this.removeNodes(),this.setCurrentState(b),this.repaint(),this.graph.connectionHandler.constraintHandler.currentFocus!=b&&this.graph.connectionHandler.constraintHandler.reset()):this.reset())}};