Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Q[X[Z]]&&Y++;Y=Y==W}Y&&(1!=R||this.isCellVisible(B[V]))&&U.push(B[V])}}return U};Graph.prototype.getAllTags=function(){return this.getTagsForCells(this.model.getDescendants(this.model.getRoot()))};Graph.prototype.getCommonTagsForCells=function(m){for(var B=null,K=[],R=0;R<m.length;R++){var U=this.getTagsForCell(m[R]);K=[];if(0<U.length){U=U.split(" ");for(var W={},Q=0;Q<U.length;Q++)if(null==B||null!=B[U[Q]])W[U[Q]]=!0,K.push(U[Q]);B=W}else return[]}return K};Graph.prototype.getTagsForCells=function(m){for(var B=
[],K={},R=0;R<m.length;R++){var U=this.getTagsForCell(m[R]);if(0<U.length){U=U.split(" ");for(var W=0;W<U.length;W++)null==K[U[W]]&&(K[U[W]]=!0,B.push(U[W]))}}return B};Graph.prototype.getTagsForCell=function(m){return this.getAttributeForCell(m,"tags","")};Graph.prototype.addTagsForCells=function(m,B){if(0<m.length&&0<B.length){this.model.beginUpdate();try{for(var K=0;K<m.length;K++){for(var R=this.getTagsForCell(m[K]),U=R.split(" "),W=!1,Q=0;Q<B.length;Q++){var V=mxUtils.trim(B[Q]);""!=V&&0>mxUtils.indexOf(U,