Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.replaceElement=function(x,L){L=x.ownerDocument.createElement(null!=L?L:"span");for(var P=Array.prototype.slice.call(x.attributes);attr=P.pop();)L.setAttribute(attr.nodeName,attr.nodeValue);L.innerHTML=x.innerHTML;x.parentNode.replaceChild(L,x)};Graph.prototype.processElements=function(x,L){if(null!=x){x=x.getElementsByTagName("*");for(var P=0;P<x.length;P++)L(x[P])}};Graph.prototype.updateLabelElements=function(x,L,P){x=null!=x?x:this.getSelectionCells();for(var X=document.createElement("div"),
ea=0;ea<x.length;ea++){var la=this.getCurrentCellStyle(x[ea]);if(null!=la&&"1"==la.html&&(la=this.convertValueToString(x[ea]),null!=la&&0<la.length)){X.innerHTML=la;for(var oa=X.getElementsByTagName(null!=P?P:"*"),xa=0;xa<oa.length;xa++)L(oa[xa]);X.innerHTML!=la&&this.cellLabelChanged(x[ea],X.innerHTML)}}};Graph.prototype.cellLabelChanged=function(x,L,P){L=Graph.zapGremlins(L);this.model.beginUpdate();try{if(null!=x.value&&"object"==typeof x.value){if(this.isReplacePlaceholders(x)&&null!=x.getAttribute("placeholder"))for(var X=