Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.updateDiagram=function(d){function g(T){var m=new mxCellOverlay(T.image||u.warningImage,T.tooltip,T.align,T.valign,T.offset);m.addListener(mxEvent.CLICK,function(B,K){t.alert(T.tooltip)});return m}var n=null,t=this;if(null!=d&&0<d.length&&(n=mxUtils.parseXml(d),d=null!=n?n.documentElement:null,null!=d&&"updates"==d.nodeName)){var u=this.editor.graph,v=u.getModel();v.beginUpdate();var A=null;try{for(d=d.firstChild;null!=d;){if("update"==d.nodeName){var H=v.getCell(d.getAttribute("id"));