Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
for(var U=Q.getElementsByTagName("a"),W=!1,P=0;P<U.length;P++)M=U[P].getAttribute("href"),null!=M&&"data:action/json,"==M.substring(0,17)&&(U[P].setAttribute("href",this.updateCustomLink(m,M)),W=!0);W&&this.labelChanged(A,Q.innerHTML)}};Graph.prototype.updateCustomLink=function(m,A){if("data:action/json,"==A.substring(0,17))try{var M=JSON.parse(A.substring(17));null!=M.actions&&(this.updateCustomLinkActions(m,M.actions),A="data:action/json,"+JSON.stringify(M))}catch(Q){}return A};Graph.prototype.updateCustomLinkActions=