Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
[];this.traverse(u,!0,mxUtils.bind(this,function(F,L){var N=null!=L&&this.isTreeEdge(L);N&&v.push(L);F==u||null!=L&&!N||v.push(F);return(null==L||N)&&(F==u||!this.model.isCollapsed(F))}));this.model.setCollapsed(u,d);for(var E=0;E<v.length;E++)this.model.setVisible(v[E],!d)}finally{this.model.endUpdate()}};Graph.prototype.isTreeEdge=function(d){return!this.isEdgeIgnored(d)};Graph.prototype.getTreeEdges=function(d,u,v,E,F,L){return this.model.filterCells(this.getEdges(d,u,v,E,F,L),mxUtils.bind(this,
function(N){return this.isTreeEdge(N)}))};Graph.prototype.getIncomingTreeEdges=function(d,u){return this.getTreeEdges(d,u,!0,!1,!1)};Graph.prototype.getOutgoingTreeEdges=function(d,u){return this.getTreeEdges(d,u,!1,!0,!1)};var f=EditorUi.prototype.init;EditorUi.prototype.init=function(){f.apply(this,arguments);this.editor.isChromelessView()&&!this.editor.editable||this.addTrees()};EditorUi.prototype.addTrees=function(){function d(D){return g.isVertex(D)&&v(D)}function u(D){var M=!1;null!=D&&(M="1"==