Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
0>mxUtils.indexOf(x,la)&&0>mxUtils.indexOf(P,la))){for(var oa=this.model.getChildCells(la,!0),xa=0,sa=0;sa<oa.length;sa++)0<=mxUtils.indexOf(x,oa[sa])&&xa++;xa==oa.length&&P.push(la)}P.push(x[X])}P=d.apply(this,[P,L])}finally{this.model.endUpdate()}return P};Graph.prototype.updateCustomLinks=function(x,L,P){P=null!=P?P:new Graph;for(var X=0;X<L.length;X++)null!=L[X]&&P.updateCustomLinksForCell(x,L[X],P)};Graph.prototype.updateCustomLinksForCell=function(x,L){this.doUpdateCustomLinksForCell(x,L);for(var P=