Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ma[ea])&&da.push(ma[ea]);this.setHiddenTags(da);this.refresh()}0<ca.length&&(R++,this.executeAnimations(ca,V,Y?1:Z.steps,Y?0:Z.delay));0==R?X():Q()}else this.stoppingCustomActions=this.executingCustomActions=!1,Q(),null!=B&&B()});X()}};Graph.prototype.doUpdateCustomLinksForCell=function(m,B){var K=this.getLinkForCell(B);null!=K&&"data:action/json,"==K.substring(0,17)&&this.setLinkForCell(B,this.updateCustomLink(m,K));if(this.isHtmlLabel(B)){var R=document.createElement("div");R.innerHTML=Graph.sanitizeHtml(this.getLabel(B));
for(var U=R.getElementsByTagName("a"),W=!1,Q=0;Q<U.length;Q++)K=U[Q].getAttribute("href"),null!=K&&"data:action/json,"==K.substring(0,17)&&(U[Q].setAttribute("href",this.updateCustomLink(m,K)),W=!0);W&&this.labelChanged(B,R.innerHTML)}};Graph.prototype.updateCustomLink=function(m,B){if("data:action/json,"==B.substring(0,17))try{var K=JSON.parse(B.substring(17));null!=K.actions&&(this.updateCustomLinkActions(m,K.actions),B="data:action/json,"+JSON.stringify(K))}catch(R){}return B};Graph.prototype.updateCustomLinkActions=