Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(m){this.model.beginUpdate();try{for(var B=0;B<m.length;B++)this.model.setVisible(m[B],!this.model.isVisible(m[B]))}finally{this.model.endUpdate()}};Graph.prototype.setCellsVisible=function(m,B){this.model.beginUpdate();try{for(var K=0;K<m.length;K++)this.model.setVisible(m[K],B)}finally{this.model.endUpdate()}};Graph.prototype.highlightCells=function(m,B,K,R){for(var U=0;U<m.length;U++)this.highlightCell(m[U],B,K,R)};Graph.prototype.highlightCell=function(m,B,K,R,U){B=null!=B?B:mxConstants.DEFAULT_VALID_COLOR;
K=null!=K?K:1E3;m=this.view.getState(m);var W=null;null!=m&&(U=null!=U?U:4,U=Math.max(U+1,mxUtils.getValue(m.style,mxConstants.STYLE_STROKEWIDTH,1)+U),W=new mxCellHighlight(this,B,U,!1),null!=R&&(W.opacity=R),W.highlight(m),window.setTimeout(function(){null!=W.shape&&(mxUtils.setPrefixedStyle(W.shape.node.style,"transition","all 1200ms ease-in-out"),W.shape.node.style.opacity=0);window.setTimeout(function(){W.destroy()},1200)},K));return W};Graph.prototype.addSvgShadow=function(m,B,K,R){K=null!=K?