Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(g,y){for(var H=0;H<y.length;H++){var O=y[H],P;for(P in O)this.updateCustomLinkAction(g,O[P],"cells"),this.updateCustomLinkAction(g,O[P],"excludeCells")}};Graph.prototype.updateCustomLinkAction=function(g,y,H){if(null!=y&&null!=y[H]){for(var O=[],P=0;P<y[H].length;P++)if("*"==y[H][P])O.push(y[H][P]);else{var V=g[y[H][P]];null!=V?""!=V&&O.push(V):O.push(y[H][P])}y[H]=O}};Graph.prototype.getCellsForAction=function(g,y){y=this.getCellsById(g.cells).concat(this.getCellsForTags(g.tags,null,y));
if(null!=g.excludeCells){for(var H=[],O=0;O<y.length;O++)0>g.excludeCells.indexOf(y[O].id)&&H.push(y[O]);y=H}return y};Graph.prototype.getCellsById=function(g){var y=[];if(null!=g)for(var H=0;H<g.length;H++)if("*"==g[H]){var O=this.model.getRoot();y=y.concat(this.model.filterDescendants(function(V){return V!=O},O))}else{var P=this.model.getCell(g[H]);null!=P&&y.push(P)}return y};var E=Graph.prototype.isCellVisible;Graph.prototype.isCellVisible=function(g){return E.apply(this,arguments)&&!this.isAllTagsHidden(this.getTagsForCell(g))};