Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(k,y){for(var G=0;G<y.length;G++){var P=y[G],Q;for(Q in P)this.updateCustomLinkAction(k,P[Q],"cells"),this.updateCustomLinkAction(k,P[Q],"excludeCells")}};Graph.prototype.updateCustomLinkAction=function(k,y,G){if(null!=y&&null!=y[G]){for(var P=[],Q=0;Q<y[G].length;Q++)if("*"==y[G][Q])P.push(y[G][Q]);else{var U=k[y[G][Q]];null!=U?""!=U&&P.push(U):P.push(y[G][Q])}y[G]=P}};Graph.prototype.getCellsForAction=function(k,y){y=this.getCellsById(k.cells).concat(this.getCellsForTags(k.tags,null,y));
if(null!=k.excludeCells){for(var G=[],P=0;P<y.length;P++)0>k.excludeCells.indexOf(y[P].id)&&G.push(y[P]);y=G}return y};Graph.prototype.getCellsById=function(k){var y=[];if(null!=k)for(var G=0;G<k.length;G++)if("*"==k[G]){var P=this.model.getRoot();y=y.concat(this.model.filterDescendants(function(U){return U!=P},P))}else{var Q=this.model.getCell(k[G]);null!=Q&&y.push(Q)}return y};var C=Graph.prototype.isCellVisible;Graph.prototype.isCellVisible=function(k){return C.apply(this,arguments)&&!this.isAllTagsHidden(this.getTagsForCell(k))};