Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.linkRelation);X.setAttribute("href",this.getAbsoluteUrl(x));X.setAttribute("title",P(this.isCustomLink(x)?this.getLinkTitle(x):x,80));null!=this.linkTarget&&X.setAttribute("target",this.linkTarget);mxUtils.write(X,P(L,40));this.isCustomLink(x)&&mxEvent.addListener(X,"click",mxUtils.bind(this,function(ea){this.customLinkClicked(x);mxEvent.consume(ea)}));return X};Graph.prototype.initTouch=function(){this.connectionHandler.marker.isEnabled=function(){return null!=this.graph.connectionHandler.first};