Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var d=this,f=d.editor.graph,k=f.getModel(),v=d.menus.createPopupMenu;d.menus.createPopupMenu=function(ba,S,da){v.apply(this,arguments);if(1==f.getSelectionCount()){S=f.getSelectionCell();var P=f.getOutgoingTreeEdges(S);ba.addSeparator();0<P.length&&(p(f.getSelectionCell())&&this.addMenuItems(ba,["selectChildren"],null,da),this.addMenuItems(ba,["selectDescendants"],null,da));p(f.getSelectionCell())?(ba.addSeparator(),0<f.getIncomingTreeEdges(S).length&&this.addMenuItems(ba,["selectSiblings","selectParent"],
null,da)):0<f.model.getEdgeCount(S)&&this.addMenuItems(ba,["selectConnections"],null,da)}};d.actions.addAction("selectChildren",function(ba){if(f.isEnabled()&&1==f.getSelectionCount()){var S=f.getSelectionCell();ba=mxEvent.isControlDown(ba)?null:f.getOutgoingTreeEdges(S);if(null!=ba&&0<ba.length){S=[];for(var da=0;da<ba.length;da++)S.push(f.model.getTerminal(ba[da],!1));f.setSelectionCells(S)}else f.setSelectionCells(f.model.getChildren(S))}},null,null,"Alt+Shift+C");d.actions.addAction("selectDescendants",