Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.setHiddenTags=function(g){this.hiddenTags=g;this.fireEvent(new mxEventObject("hiddenTagsChanged"))};Graph.prototype.toggleHiddenTag=function(g){var y=mxUtils.indexOf(this.hiddenTags,g);0>y?this.hiddenTags.push(g):0<=y&&this.hiddenTags.splice(y,1);this.fireEvent(new mxEventObject("hiddenTagsChanged"))};Graph.prototype.isAllTagsHidden=function(g){if(null==g||0==g.length||0==this.hiddenTags.length)return!1;g=g.split(" ");if(g.length>this.hiddenTags.length)return!1;for(var y=0;y<g.length;y++)if(0>
mxUtils.indexOf(this.hiddenTags,g[y]))return!1;return!0};Graph.prototype.getCellsForTags=function(g,y,H,O){var P=[];if(null!=g){y=null!=y?y:this.model.getDescendants(this.model.getRoot());for(var V=0,R={},W=0;W<g.length;W++)0<g[W].length&&(R[g[W]]=!0,V++);for(W=0;W<y.length;W++)if(H&&this.model.getParent(y[W])==this.model.root||this.model.isVertex(y[W])||this.model.isEdge(y[W])){var X=this.getTagsForCell(y[W]),Z=!1;if(0<X.length&&(X=X.split(" "),X.length>=g.length)){for(var Y=Z=0;Y<X.length&&Z<V;Y++)null!=