Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
W)&&(P=0<P.length?P+" "+W:W,U=!0)}U&&this.setAttributeForCell(k[G],"tags",P)}}finally{this.model.endUpdate()}}};Graph.prototype.removeTagsForCells=function(k,y){if(0<k.length&&0<y.length){this.model.beginUpdate();try{for(var G=0;G<k.length;G++){var P=this.getTagsForCell(k[G]);if(0<P.length){for(var Q=P.split(" "),U=!1,T=0;T<y.length;T++){var W=mxUtils.indexOf(Q,y[T]);0<=W&&(Q.splice(W,1),U=!0)}U&&this.setAttributeForCell(k[G],"tags",Q.join(" "))}}}finally{this.model.endUpdate()}}};Graph.prototype.toggleCells=