Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
for(var U=R.getElementsByTagName("a"),W=!1,Q=0;Q<U.length;Q++)K=U[Q].getAttribute("href"),null!=K&&"data:action/json,"==K.substring(0,17)&&(U[Q].setAttribute("href",this.updateCustomLink(m,K)),W=!0);W&&this.labelChanged(B,R.innerHTML)}};Graph.prototype.updateCustomLink=function(m,B){if("data:action/json,"==B.substring(0,17))try{var K=JSON.parse(B.substring(17));null!=K.actions&&(this.updateCustomLinkActions(m,K.actions),B="data:action/json,"+JSON.stringify(K))}catch(R){}return B};Graph.prototype.updateCustomLinkActions=