Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(m,B){for(var K=0;K<B.length;K++){var R=B[K],U;for(U in R)this.updateCustomLinkAction(m,R[U],"cells"),this.updateCustomLinkAction(m,R[U],"excludeCells")}};Graph.prototype.updateCustomLinkAction=function(m,B,K){if(null!=B&&null!=B[K]){for(var R=[],U=0;U<B[K].length;U++)if("*"==B[K][U])R.push(B[K][U]);else{var W=m[B[K][U]];null!=W?""!=W&&R.push(W):R.push(B[K][U])}B[K]=R}};Graph.prototype.getCellsForAction=function(m,B){B=this.getCellsById(m.cells).concat(this.getCellsForTags(m.tags,null,B));
if(null!=m.excludeCells){for(var K=[],R=0;R<B.length;R++)0>m.excludeCells.indexOf(B[R].id)&&K.push(B[R]);B=K}return B};Graph.prototype.getCellsById=function(m){var B=[];if(null!=m)for(var K=0;K<m.length;K++)if("*"==m[K]){var R=this.model.getRoot();B=B.concat(this.model.filterDescendants(function(W){return W!=R},R))}else{var U=this.model.getCell(m[K]);null!=U&&B.push(U)}return B};var J=Graph.prototype.isCellVisible;Graph.prototype.isCellVisible=function(m){return J.apply(this,arguments)&&!this.isAllTagsHidden(this.getTagsForCell(m))};