Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.getIndexableText=function(b){b=null!=b?b:this.model.getDescendants(this.model.root);for(var e=document.createElement("div"),g=[],n,y=0;y<b.length;y++)if(n=b[y],this.model.isVertex(n)||this.model.isEdge(n))this.isHtmlLabel(n)?(e.innerHTML=Graph.sanitizeHtml(this.getLabel(n)),n=mxUtils.extractTextWithWhitespace([e])):n=this.getLabel(n),n=mxUtils.trim(n.replace(/[\x00-\x1F\x7F-\x9F]|\s+/g," ")),0<n.length&&g.push(n);return g.join(" ")};