Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
b.editor.graph.rendering=!1;z.getModel().beginUpdate();try{for(var B=0,K={};E(!1,!0,!0)&&100>B;){var R=I.cell,U=z.getLabel(R),W=K[R.id];if(W&&W.replAllMrk==u&&W.replAllPos>=t)break;K[R.id]={replAllMrk:u,replAllPos:t};z.isCellEditable(R)&&(z.model.setValue(R,G(U,n,L.value,t-n.length,z.getCurrentCellStyle(R))),B++)}T!=b.currentPage&&b.editor.graph.model.execute(new SelectPage(b,T));mxUtils.write(J,mxResources.get("matchesRepl",[B]))}catch(Q){b.handleError(Q)}finally{z.getModel().endUpdate(),b.editor.graph.setSelectionCells(m),
b.editor.graph.rendering=!0}u++});N.setAttribute("title",mxResources.get("replaceAll"));N.style.float="none";N.style.width="120px";N.style.marginTop="6px";N.style.marginLeft="8px";N.style.overflow="hidden";N.style.textOverflow="ellipsis";N.className="geBtn gePrimaryBtn";N.setAttribute("disabled","disabled");A.appendChild(N);mxUtils.br(A);A.appendChild(q);q=mxUtils.button(mxResources.get("close"),mxUtils.bind(this,function(){this.window.setVisible(!1)}));q.setAttribute("title",mxResources.get("close"));