Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
if(null!=m.excludeCells){for(var K=[],R=0;R<B.length;R++)0>m.excludeCells.indexOf(B[R].id)&&K.push(B[R]);B=K}return B};Graph.prototype.getCellsById=function(m){var B=[];if(null!=m)for(var K=0;K<m.length;K++)if("*"==m[K]){var R=this.model.getRoot();B=B.concat(this.model.filterDescendants(function(W){return W!=R},R))}else{var U=this.model.getCell(m[K]);null!=U&&B.push(U)}return B};var J=Graph.prototype.isCellVisible;Graph.prototype.isCellVisible=function(m){return J.apply(this,arguments)&&!this.isAllTagsHidden(this.getTagsForCell(m))};