Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.updateDiagram=function(c){function e(V){var k=new mxCellOverlay(V.image||p.warningImage,V.tooltip,V.align,V.valign,V.offset);k.addListener(mxEvent.CLICK,function(y,G){q.alert(V.tooltip)});return k}var g=null,q=this;if(null!=c&&0<c.length&&(g=mxUtils.parseXml(c),c=null!=g?g.documentElement:null,null!=c&&"updates"==c.nodeName)){var p=this.editor.graph,t=p.getModel();t.beginUpdate();var x=null;try{for(c=c.firstChild;null!=c;){if("update"==c.nodeName){var B=t.getCell(c.getAttribute("id"));