Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
GraphViewer.prototype.addClickHandler=function(b,e){b.linkPolicy=this.graphConfig.target||b.linkPolicy;b.addClickHandler(this.graphConfig.highlight,mxUtils.bind(this,function(g,p){if(null==p)for(var y=mxEvent.getSource(g);y!=b.container&&null!=y&&null==p;)"a"==y.nodeName.toLowerCase()&&(p=y.getAttribute("href")),y=y.parentNode;null!=e?null==p||b.isCustomLink(p)?mxEvent.consume(g):b.isExternalProtocol(p)||b.isBlankLink(p)||window.setTimeout(function(){e.destroy()},0):null!=p&&null==e&&b.isCustomLink(p)&&
(mxEvent.isTouchEvent(g)||!mxEvent.isPopupTrigger(g))&&b.customLinkClicked(p)&&(mxUtils.clearSelection(),mxEvent.consume(g))}),mxUtils.bind(this,function(g){null!=e||!this.lightboxClickEnabled||mxEvent.isTouchEvent(g)&&0!=this.toolbarItems.length||this.showLightbox()}))};