Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.updateDiagram=function(d){function g(R){var m=new mxCellOverlay(R.image||u.warningImage,R.tooltip,R.align,R.valign,R.offset);m.addListener(mxEvent.CLICK,function(A,M){t.alert(R.tooltip)});return m}var n=null,t=this;if(null!=d&&0<d.length&&(n=mxUtils.parseXml(d),d=null!=n?n.documentElement:null,null!=d&&"updates"==d.nodeName)){var u=this.editor.graph,v=u.getModel();v.beginUpdate();var B=null;try{for(d=d.firstChild;null!=d;){if("update"==d.nodeName){var H=v.getCell(d.getAttribute("id"));