Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
b.editor.graph.rendering=!1;H.getModel().beginUpdate();try{for(var y=0,G={};L(!1,!0,!0)&&100>y;){var P=J.cell,Q=H.getLabel(P),U=G[P.id];if(U&&U.replAllMrk==p&&U.replAllPos>=q)break;G[P.id]={replAllMrk:p,replAllPos:q};H.isCellEditable(P)&&(H.model.setValue(P,D(Q,g,I.value,q-g.length,H.getCurrentCellStyle(P))),y++)}V!=b.currentPage&&b.editor.graph.model.execute(new SelectPage(b,V));mxUtils.write(C,mxResources.get("matchesRepl",[y]))}catch(T){b.handleError(T)}finally{H.getModel().endUpdate(),b.editor.graph.setSelectionCells(k),
b.editor.graph.rendering=!0}p++});O.setAttribute("title",mxResources.get("replaceAll"));O.style.float="none";O.style.width="120px";O.style.marginTop="6px";O.style.marginLeft="8px";O.style.overflow="hidden";O.style.textOverflow="ellipsis";O.className="geBtn gePrimaryBtn";O.setAttribute("disabled","disabled");x.appendChild(O);mxUtils.br(x);x.appendChild(n);n=mxUtils.button(mxResources.get("close"),mxUtils.bind(this,function(){this.window.setVisible(!1)}));n.setAttribute("title",mxResources.get("close"));