Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.replaceElement=function(x,L){L=x.ownerDocument.createElement(null!=L?L:"span");for(var P=Array.prototype.slice.call(x.attributes);attr=P.pop();)L.setAttribute(attr.nodeName,attr.nodeValue);L.innerHTML=x.innerHTML;x.parentNode.replaceChild(L,x)};Graph.prototype.processElements=function(x,L){if(null!=x){x=x.getElementsByTagName("*");for(var P=0;P<x.length;P++)L(x[P])}};Graph.prototype.updateLabelElements=function(x,L,P){x=null!=x?x:this.getSelectionCells();for(var X=document.createElement("div"),