Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
u.nextSibling,u.parentNode.removeChild(u),u=d;null!=u;){d=u.nextSibling;if(u.nodeType==mxConstants.NODETYPE_ELEMENT){var v=u.getAttribute("id");null==f.lookup(v)&&f.decodeCell(u)}u.parentNode.removeChild(u);u=d}}return m};b.afterDecode=function(f,m,d){d.index=d.previousIndex;return d};mxCodecRegistry.register(b)})();(function(){var b=Graph.prototype.foldCells;Graph.prototype.foldCells=function(d,u,v,E,F){u=null!=u?u:!1;null==v&&(v=this.getFoldableCells(this.getSelectionCells(),d));this.stopEditing();this.model.beginUpdate();try{for(var L=v.slice(),N=0;N<v.length;N++)"1"==mxUtils.getValue(this.getCurrentCellStyle(v[N]),"treeFolding","0")&&this.foldTreeCell(d,v[N]);v=L;v=b.apply(this,arguments)}finally{this.model.endUpdate()}return v};Graph.prototype.foldTreeCell=function(d,u){this.model.beginUpdate();try{var v=