Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
b.editor.graph.rendering=!1;z.getModel().beginUpdate();try{for(var A=0,M={};E(!1,!0,!0)&&100>A;){var Q=I.cell,U=z.getLabel(Q),W=M[Q.id];if(W&&W.replAllMrk==u&&W.replAllPos>=t)break;M[Q.id]={replAllMrk:u,replAllPos:t};z.isCellEditable(Q)&&(z.model.setValue(Q,F(U,n,L.value,t-n.length,z.getCurrentCellStyle(Q))),A++)}R!=b.currentPage&&b.editor.graph.model.execute(new SelectPage(b,R));mxUtils.write(J,mxResources.get("matchesRepl",[A]))}catch(P){b.handleError(P)}finally{z.getModel().endUpdate(),b.editor.graph.setSelectionCells(m),
b.editor.graph.rendering=!0}u++});K.setAttribute("title",mxResources.get("replaceAll"));K.style.float="none";K.style.width="120px";K.style.marginTop="6px";K.style.marginLeft="8px";K.style.overflow="hidden";K.style.textOverflow="ellipsis";K.className="geBtn gePrimaryBtn";K.setAttribute("disabled","disabled");B.appendChild(K);mxUtils.br(B);B.appendChild(q);q=mxUtils.button(mxResources.get("close"),mxUtils.bind(this,function(){this.window.setVisible(!1)}));q.setAttribute("title",mxResources.get("close"));