Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.diffCellRecursive=function(b,f,m,d,u){d=null!=d?d:{};var v=m[b.getId()];delete m[b.getId()];if(null==v)u.push(b.getId());else{var E=this.diffCell(b,v.cell);if(null!=E.parent||(null!=v.prev?null==f:null!=f)||null!=f&&null!=v.prev&&f.getId()!=v.prev.getId())E.previous=null!=v.prev?v.prev.getId():"";mxUtils.isEmptyObject(E)||(d[b.getId()]=E)}v=b.getChildCount();f=null;for(E=0;E<v;E++){var F=b.getChildAt(E);this.diffCellRecursive(F,f,m,d,u);f=F}return d};