Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
n)}}catch(t){}};EditorUi.prototype.updatePageLinksForCell=function(d,g){var n=document.createElement("div"),t=this.editor.graph,u=t.getLinkForCell(g);null!=u&&t.setLinkForCell(g,this.updatePageLink(d,u));if(t.isHtmlLabel(g)){n.innerHTML=Graph.sanitizeHtml(t.getLabel(g));for(var v=n.getElementsByTagName("a"),A=!1,H=0;H<v.length;H++)u=v[H].getAttribute("href"),null!=u&&(v[H].setAttribute("href",this.updatePageLink(d,u)),A=!0);A&&t.labelChanged(g,n.innerHTML)}for(H=0;H<t.model.getChildCount(g);H++)this.updatePageLinksForCell(d,
t.model.getChildAt(g,H))};EditorUi.prototype.updatePageLink=function(d,g){if(Graph.isPageLink(g)){var n=d[g.substring(g.indexOf(",")+1)];g=null!=n?"data:page/id,"+n:null}else if("data:action/json,"==g.substring(0,17))try{var t=JSON.parse(g.substring(17));if(null!=t.actions){for(var u=0;u<t.actions.length;u++){var v=t.actions[u];if(null!=v.open&&Graph.isPageLink(v.open)){var A=v.open.substring(v.open.indexOf(",")+1);n=d[A];null!=n?v.open="data:page/id,"+n:null==this.getPageById(A)&&delete v.open}}g=