Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.graph.setTooltips(0!=this.graphConfig.tooltips);this.graph.initialViewState={translate:this.graph.view.translate.clone(),scale:this.graph.view.scale};null!=F&&this.setLayersVisible(F);this.graph.customLinkClicked=function(k){try{if(Graph.isPageLink(k)){var v=k.indexOf(",");N.selectPageById(k.substring(v+1))||alert(mxResources.get("pageNotFound")||"Page not found")}else this.handleCustomLink(k)}catch(z){alert(z.message)}return!0};var f=this.graph.foldTreeCell;this.graph.foldTreeCell=mxUtils.bind(this,
function(){this.treeCellFolded=!0;return f.apply(this.graph,arguments)});this.fireEvent(new mxEventObject("render"))});g=window.MutationObserver||window.WebKitMutationObserver||window.MozMutationObserver;if(this.checkVisibleState&&0==b.offsetWidth&&"undefined"!==typeof g){var y=this.getObservableParent(b),q=new g(mxUtils.bind(this,function(E){0<b.offsetWidth&&(q.disconnect(),n())}));q.observe(y,{attributes:!0})}else n()}};