Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.arrayBufferIndexOfString=function(b,e,g){var n=e.charCodeAt(0),y=1,q=-1;for(g=g||0;g<b.byteLength;g++)if(b[g]==n){q=g;break}for(g=q+1;-1<q&&g<b.byteLength&&g<q+e.length-1;g++){if(b[g]!=e.charCodeAt(y))return Graph.arrayBufferIndexOfString(b,e,q+1);y++}return y==e.length-1?q:-1};Graph.compress=function(b,e){if(null==b||0==b.length||"undefined"===typeof pako)return b;b=e?pako.deflate(encodeURIComponent(b)):pako.deflateRaw(encodeURIComponent(b));return btoa(Graph.arrayBufferToString(new Uint8Array(b)))};