Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
b.editor.graph.rendering=!1;G.getModel().beginUpdate();try{for(var y=0,H={};K(!1,!0,!0)&&100>y;){var O=J.cell,P=G.getLabel(O),V=H[O.id];if(V&&V.replAllMrk==p&&V.replAllPos>=q)break;H[O.id]={replAllMrk:p,replAllPos:q};G.isCellEditable(O)&&(G.model.setValue(O,A(P,k,I.value,q-k.length,G.getCurrentCellStyle(O))),y++)}U!=b.currentPage&&b.editor.graph.model.execute(new SelectPage(b,U));mxUtils.write(E,mxResources.get("matchesRepl",[y]))}catch(R){b.handleError(R)}finally{G.getModel().endUpdate(),b.editor.graph.setSelectionCells(g),
b.editor.graph.rendering=!0}p++});L.setAttribute("title",mxResources.get("replaceAll"));L.style.float="none";L.style.width="120px";L.style.marginTop="6px";L.style.marginLeft="8px";L.style.overflow="hidden";L.style.textOverflow="ellipsis";L.className="geBtn gePrimaryBtn";L.setAttribute("disabled","disabled");x.appendChild(L);mxUtils.br(x);x.appendChild(n);n=mxUtils.button(mxResources.get("close"),mxUtils.bind(this,function(){this.window.setVisible(!1)}));n.setAttribute("title",mxResources.get("close"));