Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.tooltipHandler.show;this.tooltipHandler.show=function(){aa.apply(this,arguments);if(null!=this.div)for(var K=this.div.getElementsByTagName("a"),U=0;U<K.length;U++)null!=K[U].getAttribute("href")&&null==K[U].getAttribute("target")&&K[U].setAttribute("target","_blank")};this.tooltipHandler.getStateForEvent=function(K){return K.sourceState};this.getCursorForMouseEvent=function(K){var U=null==K.state&&null!=K.sourceState&&this.isCellLocked(K.sourceState.cell);return this.getCursorForCell(U?K.sourceState.cell:
K.getCell())};var ba=this.getCursorForCell;this.getCursorForCell=function(K){if(!this.isEnabled()||this.isCellLocked(K)){if(null!=this.getClickableLinkForCell(K))return"pointer";if(this.isCellLocked(K))return"default"}return ba.apply(this,arguments)};this.selectRegion=function(K,U){var L=mxEvent.isAltDown(U)?K:null;K=this.getCells(K.x,K.y,K.width,K.height,null,null,L,null,!0);if(this.isToggleEvent(U))for(L=0;L<K.length;L++)this.selectCellForEvent(K[L],U);else this.selectCellsForEvent(K,U);return K};