Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
V)&&(R=0<R.length?R+" "+V:V,W=!0)}W&&this.setAttributeForCell(m[K],"tags",R)}}finally{this.model.endUpdate()}}};Graph.prototype.removeTagsForCells=function(m,B){if(0<m.length&&0<B.length){this.model.beginUpdate();try{for(var K=0;K<m.length;K++){var R=this.getTagsForCell(m[K]);if(0<R.length){for(var U=R.split(" "),W=!1,Q=0;Q<B.length;Q++){var V=mxUtils.indexOf(U,B[Q]);0<=V&&(U.splice(V,1),W=!0)}W&&this.setAttributeForCell(m[K],"tags",U.join(" "))}}}finally{this.model.endUpdate()}}};Graph.prototype.toggleCells=