Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.setHiddenTags=function(k){this.hiddenTags=k;this.fireEvent(new mxEventObject("hiddenTagsChanged"))};Graph.prototype.toggleHiddenTag=function(k){var y=mxUtils.indexOf(this.hiddenTags,k);0>y?this.hiddenTags.push(k):0<=y&&this.hiddenTags.splice(y,1);this.fireEvent(new mxEventObject("hiddenTagsChanged"))};Graph.prototype.isAllTagsHidden=function(k){if(null==k||0==k.length||0==this.hiddenTags.length)return!1;k=k.split(" ");if(k.length>this.hiddenTags.length)return!1;for(var y=0;y<k.length;y++)if(0>