Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
F.cell.id,F.shape),x=!1);f(F.text)||(console.log("invalid text",F.cell.id,F.text),x=!1);x||M++;k++});console.log("states checked",k,"invalid",M)}));d.actions.addAction("testCheckFile",mxUtils.bind(this,function(){var f=null!=d.pages&&null!=d.getCurrentFile()?d.getCurrentFile().getAnonymizedXmlForPages(d.pages):"";f=new TextareaDialog(d,"Paste Data:",f,function(u){if(0<u.length)try{var D=function(F){function Q(aa){if(null==fa[aa]){if(fa[aa]=!0,null!=R[aa]){for(;0<R[aa].length;){var ea=R[aa].pop();
Q(ea)}delete R[aa]}}else mxLog.debug(N+": Visited: "+aa)}var N=F.parentNode.id,U=F.childNodes;F={};for(var R={},W=null,X={},Z=0;Z<U.length;Z++){var Y=U[Z];if(null!=Y.id&&0<Y.id.length)if(null==F[Y.id]){F[Y.id]=Y.id;var ca=Y.getAttribute("parent");null==ca?null!=W?mxLog.debug(N+": Multiple roots: "+Y.id):W=Y.id:(null==R[ca]&&(R[ca]=[]),R[ca].push(Y.id))}else X[Y.id]=Y.id}U=Object.keys(X);0<U.length?(U=N+": "+U.length+" Duplicates: "+U.join(", "),mxLog.debug(U+" (see console)")):mxLog.debug(N+": Checked");