Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
0>mxUtils.indexOf(x,la)&&0>mxUtils.indexOf(Q,la))){for(var oa=this.model.getChildCells(la,!0),xa=0,sa=0;sa<oa.length;sa++)0<=mxUtils.indexOf(x,oa[sa])&&xa++;xa==oa.length&&Q.push(la)}Q.push(x[X])}Q=d.apply(this,[Q,L])}finally{this.model.endUpdate()}return Q};Graph.prototype.updateCustomLinks=function(x,L,Q){Q=null!=Q?Q:new Graph;for(var X=0;X<L.length;X++)null!=L[X]&&Q.updateCustomLinksForCell(x,L[X],Q)};Graph.prototype.updateCustomLinksForCell=function(x,L){this.doUpdateCustomLinksForCell(x,L);for(var Q=
this.model.getChildCount(L),X=0;X<Q;X++)this.updateCustomLinksForCell(x,this.model.getChildAt(L,X))};Graph.prototype.doUpdateCustomLinksForCell=function(x,L){};Graph.prototype.getAllConnectionConstraints=function(x,L){if(null!=x){L=mxUtils.getValue(x.style,"points",null);if(null!=L){x=[];try{var Q=JSON.parse(L);for(L=0;L<Q.length;L++){var X=Q[L];x.push(new mxConnectionConstraint(new mxPoint(X[0],X[1]),2<X.length?"0"!=X[2]:!0,null,3<X.length?X[3]:0,4<X.length?X[4]:0))}}catch(la){}return x}if(null!=