Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.updateDiagram=function(c){function e(U){var g=new mxCellOverlay(U.image||p.warningImage,U.tooltip,U.align,U.valign,U.offset);g.addListener(mxEvent.CLICK,function(y,H){q.alert(U.tooltip)});return g}var k=null,q=this;if(null!=c&&0<c.length&&(k=mxUtils.parseXml(c),c=null!=k?k.documentElement:null,null!=c&&"updates"==c.nodeName)){var p=this.editor.graph,t=p.getModel();t.beginUpdate();var x=null;try{for(c=c.firstChild;null!=c;){if("update"==c.nodeName){var C=t.getCell(c.getAttribute("id"));