Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.indexOf(this.hiddenTags,k[y]))return!1;return!0};Graph.prototype.getCellsForTags=function(k,y,G,P){var Q=[];if(null!=k){y=null!=y?y:this.model.getDescendants(this.model.getRoot());for(var U=0,T={},W=0;W<k.length;W++)0<k[W].length&&(T[k[W]]=!0,U++);for(W=0;W<y.length;W++)if(G&&this.model.getParent(y[W])==this.model.root||this.model.isVertex(y[W])||this.model.isEdge(y[W])){var X=this.getTagsForCell(y[W]),Y=!1;if(0<X.length&&(X=X.split(" "),X.length>=k.length)){for(var Z=Y=0;Z<X.length&&Y<U;Z++)null!=
T[X[Z]]&&Y++;Y=Y==U}Y&&(1!=P||this.isCellVisible(y[W]))&&Q.push(y[W])}}return Q};Graph.prototype.getAllTags=function(){return this.getTagsForCells(this.model.getDescendants(this.model.getRoot()))};Graph.prototype.getCommonTagsForCells=function(k){for(var y=null,G=[],P=0;P<k.length;P++){var Q=this.getTagsForCell(k[P]);G=[];if(0<Q.length){Q=Q.split(" ");for(var U={},T=0;T<Q.length;T++)if(null==y||null!=y[Q[T]])U[Q[T]]=!0,G.push(Q[T]);y=U}else return[]}return G};Graph.prototype.getTagsForCells=function(k){for(var y=