Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.getCellsForUngroup=function(E){E=n.apply(this,arguments);for(var N=[],T=0;T<E.length;T++)this.isTable(E[T])||this.isTableRow(E[T])||this.isTableCell(E[T])||N.push(E[T]);return N};Graph.prototype.updateCssTransform=function(){var E=this.view.getDrawPane();if(null!=E)if(E=E.parentNode,this.useCssTransforms){var N=E.getAttribute("transform");E.setAttribute("transformOrigin","0 0");var T=Math.round(100*this.currentScale)/100;E.setAttribute("transform","scale("+T+","+T+")translate("+Math.round(100*