Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
t.scrollCellToVisible(t.getSelectionCell())}}}else{C=function(O){var V=M[O];null==V&&(V=new mxCell(O,new mxGeometry(0,0,80,30),"whiteSpace=wrap;html=1;"),V.vertex=!0,M[O]=V,A.push(V));return V};var M={};A=[];for(B=0;B<q.length;B++)if(";"!=q[B].charAt(0)){var K=q[B].split("->");2<=K.length&&(z=C(K[0]),D=C(K[K.length-1]),K=new mxCell(2<K.length?K[1]:"",new mxGeometry),K.edge=!0,z.insertEdge(K,!0),D.insertEdge(K,!1),A.push(K))}if(0<A.length){q=document.createElement("div");q.style.visibility="hidden";