Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null==E&&(E=T.hasAttribute(N)?null!=T.getAttribute(N)?T.getAttribute(N):"":null)),T=this.model.getParent(T);null==E&&(E=this.getGlobalVariable(N));null==E&&null!=g&&(E=g[N])}n.push(e.substring(y,match.index)+(null!=E?E:q));y=match.index+q.length}}n.push(e.substring(y))}return n.join("")};Graph.prototype.restoreSelection=function(b){if(null!=b&&0<b.length){for(var e=[],g=0;g<b.length;g++){var n=this.model.getCell(b[g].id);null!=n&&e.push(n)}this.setSelectionCells(e)}else this.clearSelection()};