Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"";else{var u=mxUtils.sortCells(l.model.getTopmostCells(l.getSelectionCells())),A=mxUtils.getXml(l.encodeCells(u));mxUtils.setTextContent(d,encodeURIComponent(A));f?(l.removeCells(u,!1),l.lastPasteXml=null):(l.lastPasteXml=A,l.pasteCounter=0);d.focus();document.execCommand("selectAll",!1,null)}};EditorUi.prototype.copyXml=function(){var d=null;if(Editor.enableNativeCipboard){var f=this.editor.graph;f.isSelectionEmpty()||(d=mxUtils.sortCells(f.getExportableCells(f.model.getTopmostCells(f.getSelectionCells()))),
f=mxUtils.getXml(f.encodeCells(d)),navigator.clipboard.writeText(f))}return d};EditorUi.prototype.pasteXml=function(d,f,l,u,A){A=null!=A?A:!0;var B=this.editor.graph,F=null;B.lastPasteXml==d?B.pasteCounter++:(B.lastPasteXml=d,B.pasteCounter=0);var M=B.pasteCounter*B.gridSize;if(l||this.isCompatibleString(d))F=this.importXml(d,M,M),B.setSelectionCells(F);else if(f&&1==B.getSelectionCount()){A=B.getStartEditingCell(B.getSelectionCell(),u);if(/\.(gif|jpg|jpeg|tiff|png|svg)$/i.test(d)&&"image"==B.getCurrentCellStyle(A)[mxConstants.STYLE_SHAPE])B.setCellStyles(mxConstants.STYLE_IMAGE,