Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.getTooltipForCell=function(b){var e="";if(mxUtils.isNode(b.value)){var g=null;Graph.translateDiagram&&null!=Graph.diagramLanguage&&(g=b.value.getAttribute("tooltip_"+Graph.diagramLanguage));null==g&&(g=b.value.getAttribute("tooltip"));if(null!=g)null!=g&&this.isReplacePlaceholders(b)&&(g=this.replacePlaceholders(b,g)),e=Graph.sanitizeHtml(g);else{g=this.builtInProperties;b=b.value.attributes;var n=[];this.isEnabled()&&(g.push("linkTarget"),g.push("link"));for(var y=0;y<b.length;y++)(Graph.translateDiagram&&
"label"==b[y].nodeName||0>mxUtils.indexOf(g,b[y].nodeName))&&0<b[y].nodeValue.length&&n.push({name:b[y].nodeName,value:b[y].nodeValue});n.sort(function(q,E){return q.name<E.name?-1:q.name>E.name?1:0});for(y=0;y<n.length;y++)"link"==n[y].name&&this.isCustomLink(n[y].value)||(e+=("link"!=n[y].name?"<b>"+mxUtils.htmlEntities(n[y].name)+":</b> ":"")+mxUtils.htmlEntities(n[y].value)+"\n");0<e.length&&(e=e.substring(0,e.length-1),mxClient.IS_SVG&&(e='<div style="max-width:360px;text-overflow:ellipsis;overflow:hidden;">'+
e+"</div>"))}}return e};Graph.prototype.getFlowAnimationStyle=function(){var b=document.getElementsByTagName("head")[0];if(null!=b&&null==this.flowAnimationStyle){this.flowAnimationStyle=document.createElement("style");this.flowAnimationStyle.setAttribute("id","geEditorFlowAnimation-"+Editor.guid());this.flowAnimationStyle.type="text/css";var e=this.flowAnimationStyle.getAttribute("id");this.flowAnimationStyle.innerHTML=this.getFlowAnimationStyleCss(e);b.appendChild(this.flowAnimationStyle)}return this.flowAnimationStyle};