Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
[],H={},O=0;O<g.length;O++){var P=this.getTagsForCell(g[O]);if(0<P.length){P=P.split(" ");for(var V=0;V<P.length;V++)null==H[P[V]]&&(H[P[V]]=!0,y.push(P[V]))}}return y};Graph.prototype.getTagsForCell=function(g){return this.getAttributeForCell(g,"tags","")};Graph.prototype.addTagsForCells=function(g,y){if(0<g.length&&0<y.length){this.model.beginUpdate();try{for(var H=0;H<g.length;H++){for(var O=this.getTagsForCell(g[H]),P=O.split(" "),V=!1,R=0;R<y.length;R++){var W=mxUtils.trim(y[R]);""!=W&&0>mxUtils.indexOf(P,