Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
na[ea])&&ha.push(na[ea]);this.setHiddenTags(ha);this.refresh()}0<ca.length&&(P++,this.executeAnimations(ca,W,Y?1:Z.steps,Y?0:Z.delay));0==P?X():T()}else this.stoppingCustomActions=this.executingCustomActions=!1,T(),null!=y&&y()});X()}};Graph.prototype.doUpdateCustomLinksForCell=function(k,y){var G=this.getLinkForCell(y);null!=G&&"data:action/json,"==G.substring(0,17)&&this.setLinkForCell(y,this.updateCustomLink(k,G));if(this.isHtmlLabel(y)){var P=document.createElement("div");P.innerHTML=Graph.sanitizeHtml(this.getLabel(y));
for(var Q=P.getElementsByTagName("a"),U=!1,T=0;T<Q.length;T++)G=Q[T].getAttribute("href"),null!=G&&"data:action/json,"==G.substring(0,17)&&(Q[T].setAttribute("href",this.updateCustomLink(k,G)),U=!0);U&&this.labelChanged(y,P.innerHTML)}};Graph.prototype.updateCustomLink=function(k,y){if("data:action/json,"==y.substring(0,17))try{var G=JSON.parse(y.substring(17));null!=G.actions&&(this.updateCustomLinkActions(k,G.actions),y="data:action/json,"+JSON.stringify(G))}catch(P){}return y};Graph.prototype.updateCustomLinkActions=