Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.openLink=function(b,e,g){var n=window;try{if(b=Graph.sanitizeLink(b),null!=b)if("_self"==e&&window!=window.top)window.location.href=b;else if(b.substring(0,this.baseUrl.length)==this.baseUrl&&"#"==b.charAt(this.baseUrl.length)&&"_top"==e&&window==window.top){var y=b.split("#")[1];window.location.hash=="#"+y&&(window.location.hash="");window.location.hash=y}else n=window.open(b,null!=e?e:"_blank"),null==n||g||(n.opener=null)}catch(q){}return n};