Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
[],G={},P=0;P<k.length;P++){var Q=this.getTagsForCell(k[P]);if(0<Q.length){Q=Q.split(" ");for(var U=0;U<Q.length;U++)null==G[Q[U]]&&(G[Q[U]]=!0,y.push(Q[U]))}}return y};Graph.prototype.getTagsForCell=function(k){return this.getAttributeForCell(k,"tags","")};Graph.prototype.addTagsForCells=function(k,y){if(0<k.length&&0<y.length){this.model.beginUpdate();try{for(var G=0;G<k.length;G++){for(var P=this.getTagsForCell(k[G]),Q=P.split(" "),U=!1,T=0;T<y.length;T++){var W=mxUtils.trim(y[T]);""!=W&&0>mxUtils.indexOf(Q,