Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.getIndexableText=function(b){b=null!=b?b:this.model.getDescendants(this.model.root);for(var e=document.createElement("div"),g=[],p,y=0;y<b.length;y++)if(p=b[y],this.model.isVertex(p)||this.model.isEdge(p))this.isHtmlLabel(p)?(e.innerHTML=Graph.sanitizeHtml(this.getLabel(p)),p=mxUtils.extractTextWithWhitespace([e])):p=this.getLabel(p),p=mxUtils.trim(p.replace(/[\x00-\x1F\x7F-\x9F]|\s+/g," ")),0<p.length&&g.push(p);return g.join(" ")};