Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
for(var Q=P.getElementsByTagName("a"),U=!1,T=0;T<Q.length;T++)G=Q[T].getAttribute("href"),null!=G&&"data:action/json,"==G.substring(0,17)&&(Q[T].setAttribute("href",this.updateCustomLink(k,G)),U=!0);U&&this.labelChanged(y,P.innerHTML)}};Graph.prototype.updateCustomLink=function(k,y){if("data:action/json,"==y.substring(0,17))try{var G=JSON.parse(y.substring(17));null!=G.actions&&(this.updateCustomLinkActions(k,G.actions),y="data:action/json,"+JSON.stringify(G))}catch(P){}return y};Graph.prototype.updateCustomLinkActions=