Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(m,A){for(var M=0;M<A.length;M++){var Q=A[M],U;for(U in Q)this.updateCustomLinkAction(m,Q[U],"cells"),this.updateCustomLinkAction(m,Q[U],"excludeCells")}};Graph.prototype.updateCustomLinkAction=function(m,A,M){if(null!=A&&null!=A[M]){for(var Q=[],U=0;U<A[M].length;U++)if("*"==A[M][U])Q.push(A[M][U]);else{var W=m[A[M][U]];null!=W?""!=W&&Q.push(W):Q.push(A[M][U])}A[M]=Q}};Graph.prototype.getCellsForAction=function(m,A){A=this.getCellsById(m.cells).concat(this.getCellsForTags(m.tags,null,A));
if(null!=m.excludeCells){for(var M=[],Q=0;Q<A.length;Q++)0>m.excludeCells.indexOf(A[Q].id)&&M.push(A[Q]);A=M}return A};Graph.prototype.getCellsById=function(m){var A=[];if(null!=m)for(var M=0;M<m.length;M++)if("*"==m[M]){var Q=this.model.getRoot();A=A.concat(this.model.filterDescendants(function(W){return W!=Q},Q))}else{var U=this.model.getCell(m[M]);null!=U&&A.push(U)}return A};var J=Graph.prototype.isCellVisible;Graph.prototype.isCellVisible=function(m){return J.apply(this,arguments)&&!this.isAllTagsHidden(this.getTagsForCell(m))};