Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.updateSelectionStateForCell=function(b,e,g,n){g=this.editor.graph;b.cells.push(e);if(g.getModel().isVertex(e)){b.connections=0<g.model.getEdgeCount(e);b.unlocked=b.unlocked&&!g.isCellLocked(e);b.resizable=b.resizable&&g.isCellResizable(e);b.rotatable=b.rotatable&&g.isCellRotatable(e);b.movable=b.movable&&g.isCellMovable(e)&&!g.isTableRow(e)&&!g.isTableCell(e);b.swimlane=b.swimlane||g.isSwimlane(e);b.table=b.table||g.isTable(e);b.cell=b.cell||g.isTableCell(e);b.row=b.row||g.isTableRow(e);
b.vertices.push(e);var y=g.getCellGeometry(e);if(null!=y&&(0<y.width?null==b.width?b.width=y.width:b.width!=y.width&&(b.width=""):b.containsLabel=!0,0<y.height?null==b.height?b.height=y.height:b.height!=y.height&&(b.height=""):b.containsLabel=!0,!y.relative||null!=y.offset)){var q=y.relative?y.offset.x:y.x;y=y.relative?y.offset.y:y.y;null==b.x?b.x=q:b.x!=q&&(b.x="");null==b.y?b.y=y:b.y!=y&&(b.y="")}}else g.getModel().isEdge(e)&&(b.edges.push(e),b.connections=!0,b.resizable=!1,b.rotatable=!1,b.movable=
!1);e=g.view.getState(e);null!=e&&(b.autoSize=b.autoSize||g.isAutoSizeState(e),b.glass=b.glass&&g.isGlassState(e),b.rounded=b.rounded&&g.isRoundedState(e),b.lineJumps=b.lineJumps&&g.isLineJumpState(e),b.image=b.image||g.isImageState(e),b.shadow=b.shadow&&g.isShadowState(e),b.fill=b.fill&&g.isFillState(e),b.gradient=b.fill&&g.isGradientState(e),b.stroke=b.stroke&&g.isStrokeState(e),q=mxUtils.getValue(e.style,mxConstants.STYLE_SHAPE,null),b.containsImage=b.containsImage||"image"==q,g.mergeStyle(e.style,
b.style,n))};