Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
P.appendChild(ea);L.appendChild(P)}};Graph.prototype.updateSvgLinks=function(x,L,P){x=x.getElementsByTagName("a");for(var X=0;X<x.length;X++)if(null==x[X].getAttribute("target")){var ea=x[X].getAttribute("href");null==ea&&(ea=x[X].getAttribute("xlink:href"));null!=ea&&(null!=L&&/^https?:\/\//.test(ea)?x[X].setAttribute("target",L):P&&this.isCustomLink(ea)&&x[X].setAttribute("href","javascript:void(0);"))}};Graph.prototype.createSvgCanvas=function(x){x=new mxSvgCanvas2D(x);x.minStrokeWidth=this.cellRenderer.minSvgStrokeWidth;
x.pointerEvents=!0;return x};Graph.prototype.getSelectedTextBlocks=function(){function x(oa){if(oa.firstChild)return oa.firstChild;for(;oa;){if(oa.nextSibling)return oa.nextSibling;oa=oa.parentNode}}function L(oa){var xa=oa.startContainer,sa=oa.endContainer;oa=oa.commonAncestorContainer;var va=[],Fa;for(Fa=xa.parentNode;Fa&&(va.push(Fa),Fa!=oa);Fa=Fa.parentNode);va.reverse();for(Fa=xa;Fa&&(va.push(Fa),Fa!=sa);Fa=x(Fa));return va}var P=[this.getSelectedElement()];if(window.getSelection){var X=window.getSelection();