Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.isEnabled()&&(S=U.getProperty("event"),U=S.getState(),!mxEvent.isAltDown(S.getEvent())&&null!=U&&this.model.isEdge(U.cell)&&(E=new mxPoint(S.getGraphX(),S.getGraphY()),K=this.isCellSelected(U.cell),T=U,N=S,null!=U.text&&null!=U.text.boundingBox&&mxUtils.contains(U.text.boundingBox,S.getGraphX(),S.getGraphY())?F=mxEvent.LABEL_HANDLE:(U=this.selectionCellsHandler.getHandler(U.cell),null!=U&&null!=U.bends&&0<U.bends.length&&(F=U.getHandleForEvent(S)))))}));this.addMouseListener({mouseDown:function(S,
U){},mouseMove:mxUtils.bind(this,function(S,U){S=this.selectionCellsHandler.handlers.map;for(var Q in S)if(null!=S[Q].index)return;if(this.isEnabled()&&!this.panningHandler.isActive()&&!mxEvent.isAltDown(U.getEvent())){var Y=this.tolerance;if(null!=E&&null!=T&&null!=N){if(Q=T,null!=F||Math.abs(E.x-U.getGraphX())>Y||Math.abs(E.y-U.getGraphY())>Y){var m=this.selectionCellsHandler.getHandler(Q.cell);if(null!=m&&null!=m.bends&&0<m.bends.length){m.redrawHandles();S=null!=F?F:m.getHandleForEvent(N);var C=