Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(k){this.model.beginUpdate();try{for(var y=0;y<k.length;y++)this.model.setVisible(k[y],!this.model.isVisible(k[y]))}finally{this.model.endUpdate()}};Graph.prototype.setCellsVisible=function(k,y){this.model.beginUpdate();try{for(var G=0;G<k.length;G++)this.model.setVisible(k[G],y)}finally{this.model.endUpdate()}};Graph.prototype.highlightCells=function(k,y,G,P){for(var Q=0;Q<k.length;Q++)this.highlightCell(k[Q],y,G,P)};Graph.prototype.highlightCell=function(k,y,G,P,Q){y=null!=y?y:mxConstants.DEFAULT_VALID_COLOR;