Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(m,B){for(var K=0;K<B.length;K++){var R=B[K],U;for(U in R)this.updateCustomLinkAction(m,R[U],"cells"),this.updateCustomLinkAction(m,R[U],"excludeCells")}};Graph.prototype.updateCustomLinkAction=function(m,B,K){if(null!=B&&null!=B[K]){for(var R=[],U=0;U<B[K].length;U++)if("*"==B[K][U])R.push(B[K][U]);else{var W=m[B[K][U]];null!=W?""!=W&&R.push(W):R.push(B[K][U])}B[K]=R}};Graph.prototype.getCellsForAction=function(m,B){B=this.getCellsById(m.cells).concat(this.getCellsForTags(m.tags,null,B));