Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
K.cell.id,K.text),S=!1);S||F++;O++});console.log("states checked",O,"invalid",F)}));c.actions.addAction("testCheckFile",mxUtils.bind(this,function(){var p=null!=c.pages&&null!=c.getCurrentFile()?c.getCurrentFile().getAnonymizedXmlForPages(c.pages):"";p=new TextareaDialog(c,"Paste Data:",p,function(q){if(0<q.length)try{var C=function(K){function R(Y){if(null==X[Y]){if(X[Y]=!0,null!=M[Y]){for(;0<M[Y].length;){var Z=M[Y].pop();R(Z)}delete M[Y]}}else mxLog.debug(m+": Visited: "+Y)}var m=K.parentNode.id,
A=K.childNodes;K={};for(var M={},Q=null,U={},W=0;W<A.length;W++){var P=A[W];if(null!=P.id&&0<P.id.length)if(null==K[P.id]){K[P.id]=P.id;var V=P.getAttribute("parent");null==V?null!=Q?mxLog.debug(m+": Multiple roots: "+P.id):Q=P.id:(null==M[V]&&(M[V]=[]),M[V].push(P.id))}else U[P.id]=P.id}A=Object.keys(U);0<A.length?(A=m+": "+A.length+" Duplicates: "+A.join(", "),mxLog.debug(A+" (see console)")):mxLog.debug(m+": Checked");var X={};null==Q?mxLog.debug(m+": No root"):(R(Q),Object.keys(X).length!=Object.keys(K).length&&
(mxLog.debug(m+": Invalid tree: (see console)"),console.log(m+": Invalid tree",M)))};"<"!=q.charAt(0)&&(q=Graph.decompress(q),mxLog.debug("See console for uncompressed XML"),console.log("xml",q));var J=mxUtils.parseXml(q),F=c.getPagesForNode(J.documentElement,"mxGraphModel");if(null!=F&&0<F.length)try{var O=c.getHashValueForPages(F);mxLog.debug("Checksum: ",O)}catch(K){mxLog.debug("Error: ",K.message)}else mxLog.debug("No pages found for checksum");var S=J.getElementsByTagName("root");for(q=0;q<S.length;q++)C(S[q]);