Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.getCurrentFile();null!=U&&ca!=U.getTitle()&&(ca=null!=U.getTitle()?U.getTitle():this.defaultFilename,f.invalidateDescendantsWithPlaceholders(f.model.getRoot()),f.view.validate())});var ia=f.labelLinkClicked;f.labelLinkClicked=function(U,Q,Y){var m=Q.getAttribute("href");if(null==m||!f.isCustomLink(m)||!mxEvent.isTouchEvent(Y)&&mxEvent.isPopupTrigger(Y))ia.apply(this,arguments);else{if(!f.isEnabled()||null!=U&&f.isCellLocked(U.cell))f.customLinkClicked(m),f.getRubberband().reset();mxEvent.consume(Y)}};