Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.visitTableCells=function(b,e){var g=null,n=this.model.getChildCells(b,!0);b=this.getActualStartSize(b,!0);for(var y=0;y<n.length;y++){for(var q=this.getActualStartSize(n[y],!0),E=this.model.getChildCells(n[y],!0),N=this.getCellStyle(n[y],!0),T=null,F=[],K=0;K<E.length;K++){var R=this.getCellGeometry(E[K]),W={cell:E[K],rospan:1,colspan:1,row:y,col:K,geo:R};R=null!=R.alternateBounds?R.alternateBounds:R;W.point=new mxPoint(R.width+(null!=T?T.point.x:b.x+q.x),R.height+(null!=g&&null!=
g[0]?g[0].point.y:b.y+q.y));W.actual=W;null!=g&&null!=g[K]&&1<g[K].rowspan?(W.rowspan=g[K].rowspan-1,W.colspan=g[K].colspan,W.actual=g[K].actual):null!=T&&1<T.colspan?(W.rowspan=T.rowspan,W.colspan=T.colspan-1,W.actual=T.actual):(T=this.getCurrentCellStyle(E[K],!0),null!=T&&(W.rowspan=parseInt(T.rowspan||1),W.colspan=parseInt(T.colspan||1)));T=1==mxUtils.getValue(N,mxConstants.STYLE_SWIMLANE_HEAD,1)&&mxUtils.getValue(N,mxConstants.STYLE_STROKECOLOR,mxConstants.NONE)!=mxConstants.NONE;e(W,E.length,
n.length,b.x+(T?q.x:0),b.y+(T?q.y:0));F.push(W);T=W}g=F}};Graph.prototype.getTableLines=function(b,e,g){var n=[],y=[];(e||g)&&this.visitTableCells(b,mxUtils.bind(this,function(q,E,N,T,F){e&&q.row<N-1&&(null==n[q.row]&&(n[q.row]=[new mxPoint(T,q.point.y)]),1<q.rowspan&&n[q.row].push(null),n[q.row].push(q.point));g&&q.col<E-1&&(null==y[q.col]&&(y[q.col]=[new mxPoint(q.point.x,F)]),1<q.colspan&&y[q.col].push(null),y[q.col].push(q.point))}));return n.concat(y)};