Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.setHiddenTags=function(m){this.hiddenTags=m;this.fireEvent(new mxEventObject("hiddenTagsChanged"))};Graph.prototype.toggleHiddenTag=function(m){var A=mxUtils.indexOf(this.hiddenTags,m);0>A?this.hiddenTags.push(m):0<=A&&this.hiddenTags.splice(A,1);this.fireEvent(new mxEventObject("hiddenTagsChanged"))};Graph.prototype.isAllTagsHidden=function(m){if(null==m||0==m.length||0==this.hiddenTags.length)return!1;m=m.split(" ");if(m.length>this.hiddenTags.length)return!1;for(var A=0;A<m.length;A++)if(0>
mxUtils.indexOf(this.hiddenTags,m[A]))return!1;return!0};Graph.prototype.getCellsForTags=function(m,A,M,Q){var U=[];if(null!=m){A=null!=A?A:this.model.getDescendants(this.model.getRoot());for(var W=0,P={},V=0;V<m.length;V++)0<m[V].length&&(P[m[V]]=!0,W++);for(V=0;V<A.length;V++)if(M&&this.model.getParent(A[V])==this.model.root||this.model.isVertex(A[V])||this.model.isEdge(A[V])){var X=this.getTagsForCell(A[V]),Y=!1;if(0<X.length&&(X=X.split(" "),X.length>=m.length)){for(var Z=Y=0;Z<X.length&&Y<W;Z++)null!=