Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.convertValueToString=function(b){var e=this.model.getValue(b);if(null!=e&&"object"==typeof e){var g=null;if(this.isReplacePlaceholders(b)&&null!=b.getAttribute("placeholder")){e=b.getAttribute("placeholder");for(var n=b;null==g&&null!=n;)null!=n.value&&"object"==typeof n.value&&(g=n.hasAttribute(e)?null!=n.getAttribute(e)?n.getAttribute(e):"":null),n=this.model.getParent(n)}else g=null,Graph.translateDiagram&&null!=Graph.diagramLanguage&&(g=e.getAttribute("label_"+Graph.diagramLanguage)),
null==g&&(g=e.getAttribute("label")||"");return g||""}return mxGraph.prototype.convertValueToString.apply(this,arguments)};Graph.prototype.getLinksForState=function(b){return null!=b&&null!=b.text&&null!=b.text.node?b.text.node.getElementsByTagName("a"):null};Graph.prototype.getLinkForCell=function(b){return null!=b.value&&"object"==typeof b.value?(b=b.value.getAttribute("link"),null!=b&&"javascript:"===b.toLowerCase().substring(0,11)&&(b=b.substring(11)),b):null};