Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"cells",[J])),b.fireEvent(new mxEventObject("freehandInserted","cell",J))}finally{b.model.endUpdate()}t&&b.setSelectionCells([J])}}for(J=0;J<k.length;J++)k[J].parentNode.removeChild(k[J]);c=null;k=[];x=[]}A(!1)};b.addListener(mxEvent.FIRE_MOUSE_EVENT,mxUtils.bind(this,function(C,J){C=J.getProperty("eventName");J=J.getProperty("event");C==mxEvent.MOUSE_MOVE&&g&&(null!=J.sourceState&&J.sourceState.setCursor("crosshair"),J.consume())}));b.addMouseListener({mouseDown:mxUtils.bind(this,function(C,J){if(b.isEnabled()&&