Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.selectTableRange=function(b,e){var g=!1;if(this.isTableCell(b)&&this.isTableCell(e)){var n=this.model.getParent(b),y=this.model.getParent(n),q=this.model.getParent(e);if(y==this.model.getParent(q)){b=n.getIndex(b);n=y.getIndex(n);var E=q.getIndex(e),N=y.getIndex(q);q=Math.max(n,N);e=Math.min(b,E);b=Math.max(b,E);E=[];for(n=Math.min(n,N);n<=q;n++){N=this.model.getChildAt(y,n);for(var T=e;T<=b;T++)E.push(this.model.getChildAt(N,T))}0<E.length&&(1<E.length||1<this.getSelectionCount()||
!this.isCellSelected(E[0]))&&(this.setSelectionCells(E),g=!0)}}return g};